imapflow 1.4.8 → 1.4.9

package/lib/commands/search.js

@@ -1,8 +1,24 @@
 'use strict';
 
-const { enhanceCommandError } = require('../tools.js');
+const { enhanceCommandError, hasCapability, isValidSequenceValue } = require('../tools.js');
 const { searchCompiler } = require('../search-compiler.js');
 
+/**
+ * Strips the leading (TAG "X") correlator list and the optional UID atom from an
+ * ESEARCH untagged response, leaving only the result keyword/value pairs.
+ * The IMAP parser represents parenthesized groups as plain Arrays, not objects
+ * with type: 'LIST'.
+ *
+ * @param {Array} attrs - Raw attribute array from the IMAP parser
+ * @returns {Array} Attribute array starting at the first result keyword
+ */
+const stripEsearchPrefix = attrs => {
+    let start = 0;
+    if (attrs[start] && Array.isArray(attrs[start])) start++;
+    if (attrs[start] && typeof attrs[start].value === 'string' && attrs[start].value.toUpperCase() === 'UID') start++;
+    return attrs.slice(start);
+};
+
 /**
  * Parses the key-value attributes from an ESEARCH untagged response.
  *
@@ -54,9 +70,7 @@ function parseEsearchResponse(attrs) {
             }
             case 'PARTIAL': {
                 const listToken = attrs[++i];
-                // Parser represents parenthesized groups as plain Arrays,
-                // but check both forms for robustness.
-                const items = Array.isArray(listToken) ? listToken : listToken && Array.isArray(listToken.attributes) ? listToken.attributes : null;
+                const items = Array.isArray(listToken) ? listToken : null;
                 if (!items || items.length < 2) break;
                 result.partial = {
                     range: items[0].value,
@@ -113,7 +127,8 @@ module.exports = async (connection, query, options) => {
         return false;
     }
 
-    const useEsearch = options.returnOptions && options.returnOptions.length > 0 && connection.capabilities.has('ESEARCH');
+    // ESEARCH is part of base IMAP4rev2
+    const useEsearch = options.returnOptions && options.returnOptions.length > 0 && hasCapability(connection, 'ESEARCH');
 
     if (useEsearch) {
         // Build RETURN (...) item list
@@ -142,14 +157,7 @@ module.exports = async (connection, query, options) => {
                     untagged: {
                         ESEARCH: async untagged => {
                             if (!untagged || !untagged.attributes) return;
-                            // Strip leading (TAG "X") list and optional UID atom.
-                            // The IMAP parser represents parenthesized groups as
-                            // plain Arrays, not objects with type: 'LIST'.
-                            let attrs = untagged.attributes;
-                            let start = 0;
-                            if (attrs[start] && (Array.isArray(attrs[start]) || attrs[start].type === 'LIST')) start++;
-                            if (attrs[start] && typeof attrs[start].value === 'string' && attrs[start].value.toUpperCase() === 'UID') start++;
-                            esearchResult = parseEsearchResponse(attrs.slice(start));
+                            esearchResult = parseEsearchResponse(stripEsearchPrefix(untagged.attributes));
                         }
                     }
                 });
@@ -180,6 +188,73 @@ module.exports = async (connection, query, options) => {
                             }
                         });
                     }
+                },
+
+                // IMAP4rev2 servers answer even a plain SEARCH with an untagged
+                // ESEARCH response (RFC 9051 deprecated the SEARCH response), so
+                // both forms are collected into the same result set
+                ESEARCH: async untagged => {
+                    if (!untagged || !untagged.attributes) {
+                        return;
+                    }
+                    let parsed = parseEsearchResponse(stripEsearchPrefix(untagged.attributes));
+                    if (parsed.all) {
+                        // Walk the compact sequence-set directly into the Set - the ALL
+                        // result may cover the entire mailbox, so expanding it into an
+                        // intermediate array first would double the peak memory use.
+                        // The set comes from an untrusted server: endpoints must be
+                        // valid nz-numbers ('Infinity' would otherwise loop forever)
+                        // and the expansion stops at the mailbox EXISTS count - a
+                        // conforming server cannot match more messages than exist, so
+                        // a hostile range like 1:4294967295 cannot exhaust memory.
+                        // A '*' means "largest number in use": that is exactly EXISTS
+                        // for message sequence numbers, while server-sent UID sets may
+                        // not contain '*' at all (RFC 9051 section 4.1.1), so UID
+                        // parts with '*' are dropped
+                        let existsCount = () => (connection.mailbox && connection.mailbox.exists) || 0;
+                        let overBudget = () => results.size >= existsCount();
+                        let resolveId = part => (part === '*' ? (options.uid ? 0 : existsCount()) : Number(part));
+                        let truncated = false;
+                        let discarded = false;
+                        sequenceSetLoop: for (let part of parsed.all.split(',')) {
+                            part = part.trim();
+                            let colon = part.indexOf(':');
+                            if (colon < 0) {
+                                let value = resolveId(part);
+                                if (!isValidSequenceValue(value)) {
+                                    discarded = true;
+                                    continue;
+                                }
+                                if (overBudget()) {
+                                    truncated = true;
+                                    break;
+                                }
+                                results.add(value);
+                                continue;
+                            }
+                            let first = resolveId(part.substr(0, colon));
+                            let second = resolveId(part.substr(colon + 1));
+                            if (!isValidSequenceValue(first) || !isValidSequenceValue(second)) {
+                                discarded = true;
+                                continue;
+                            }
+                            for (let id = Math.min(first, second); id <= Math.max(first, second); id++) {
+                                if (overBudget()) {
+                                    truncated = true;
+                                    break sequenceSetLoop;
+                                }
+                                results.add(id);
+                            }
+                        }
+                        if (truncated || discarded) {
+                            connection.log.warn({
+                                msg: 'Invalid entries in the ESEARCH ALL result',
+                                truncated,
+                                discarded,
+                                cid: connection.id
+                            });
+                        }
+                    }
                 }
             }
         });

package/lib/commands/status.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { encodePath, normalizePath } = require('../tools.js');
+const { encodePath, normalizePath, buildStatusQueryAttributes, isRev2Active } = require('../tools.js');
 
 /**
  * Requests status information about a mailbox.
@@ -24,33 +24,18 @@ module.exports = async (connection, path, query) => {
     // otherwise use unquoted ATOM. Same approach as in SELECT.
     let attributes = [{ type: encodedPath.indexOf('&') >= 0 ? 'STRING' : 'ATOM', value: encodedPath }];
 
-    // Build the list of STATUS data items the caller wants.
-    // HIGHESTMODSEQ requires the CONDSTORE extension to be available.
-    let queryAttributes = [];
-    Object.keys(query || {}).forEach(key => {
-        if (!query[key]) {
-            return;
-        }
+    // Build the list of STATUS data items the caller wants
+    let queryAttributes = buildStatusQueryAttributes(connection, query);
 
-        switch (key.toUpperCase()) {
-            case 'MESSAGES':
-            case 'RECENT':
-            case 'UIDNEXT':
-            case 'UIDVALIDITY':
-            case 'UNSEEN':
-                queryAttributes.push({ type: 'ATOM', value: key.toUpperCase() });
-                break;
-
-            case 'HIGHESTMODSEQ':
-                if (connection.capabilities.has('CONDSTORE')) {
-                    queryAttributes.push({ type: 'ATOM', value: key.toUpperCase() });
-                }
-                break;
-        }
-    });
+    // RECENT does not exist in IMAP4rev2 so it is never requested from a rev2
+    // session; its defined value there is always 0. Synthesizing it keeps the
+    // return shape identical to a rev1 session for the same query.
+    let syntheticRecent = query && query.recent && isRev2Active(connection);
 
     if (!queryAttributes.length) {
-        return false;
+        // A query that only contained items unavailable on this session - the
+        // caller still gets a status object if every such item has a defined value
+        return syntheticRecent ? { path, recent: 0 } : false;
     }
 
     attributes.push(queryAttributes);
@@ -134,6 +119,9 @@ module.exports = async (connection, path, query) => {
             }
         });
         response.next();
+        if (syntheticRecent) {
+            map.recent = 0;
+        }
         return map;
     } catch (err) {
         // A NO response usually means the mailbox doesn't exist. Verify by

package/lib/imap-flow.d.ts

@@ -54,6 +54,8 @@ export interface ImapFlowOptions {
     disableBinary?: boolean;
     /** If true, do not enable supported extensions */
     disableAutoEnable?: boolean;
+    /** If true, do not enable IMAP4rev2 mode even if the server supports it */
+    disableIMAP4rev2?: boolean;
     /** How long to wait for the connection to be established. Defaults to 90 seconds */
     connectionTimeout?: number;
     /** How long to wait for the greeting. Defaults to 16 seconds */
@@ -103,7 +105,7 @@ export interface MailboxObject {
     specialUse?: string;
     /** True if mailbox was found from the output of LIST command */
     listed?: boolean;
-    /** True if mailbox was found from the output of LSUB command */
+    /** True if the mailbox is subscribed - reported by LSUB or by LIST RETURN (SUBSCRIBED) on LIST-EXTENDED/IMAP4rev2 servers */
     subscribed?: boolean;
     /** A Set of flags available to use in this mailbox. If it is not set or includes special flag "\*" then any flag can be used */
     permanentFlags?: Set<string>;
@@ -184,7 +186,7 @@ export interface ListResponse {
     specialUse?: string;
     /** True if mailbox was found from the output of LIST command */
     listed: boolean;
-    /** True if mailbox was found from the output of LSUB command */
+    /** True if the mailbox is subscribed - reported by LSUB or by LIST RETURN (SUBSCRIBED) on LIST-EXTENDED/IMAP4rev2 servers */
     subscribed: boolean;
     /** If statusQuery was used, then this value includes the status response */
     status?: StatusObject;
@@ -234,7 +236,7 @@ export interface ListTreeResponse {
     specialUse?: string;
     /** True if mailbox was found from the output of LIST command */
     listed?: boolean;
-    /** True if mailbox was found from the output of LSUB command */
+    /** True if the mailbox is subscribed - reported by LSUB or by LIST RETURN (SUBSCRIBED) on LIST-EXTENDED/IMAP4rev2 servers */
     subscribed?: boolean;
     /** If true then this mailbox can not be selected in the UI */
     disabled?: boolean;

package/lib/imap-flow.js

@@ -35,7 +35,8 @@ const {
     normalizePath,
     expandRange,
     AuthenticationFailure,
-    getColorFlags
+    getColorFlags,
+    hasCapability
 } = require('./tools');
 
 const imapCommands = require('./imap-commands.js');
@@ -69,7 +70,7 @@ const states = {
  * @property {Set<string>} flags list of flags for this mailbox
  * @property {String} [specialUse] one of special-use flags (if applicable): "\All", "\Archive", "\Drafts", "\Flagged", "\Junk", "\Sent", "\Trash". Additionally INBOX has non-standard "\Inbox" flag set
  * @property {Boolean} listed `true` if mailbox was found from the output of LIST command
- * @property {Boolean} subscribed `true` if mailbox was found from the output of LSUB command
+ * @property {Boolean} subscribed `true` if the mailbox is subscribed - reported by LSUB or by LIST RETURN (SUBSCRIBED) on LIST-EXTENDED/IMAP4rev2 servers
  * @property {Set<string>} permanentFlags A Set of flags available to use in this mailbox. If it is not set or includes special flag "\\\*" then any flag can be used.
  * @property {String} [mailboxId] unique mailbox ID if server has `OBJECTID` extension enabled
  * @property {BigInt} [highestModseq] latest known modseq value if server has CONDSTORE or XYMHIGHESTMODSEQ enabled
@@ -221,6 +222,11 @@ class ImapFlow extends EventEmitter {
      * @property {Boolean} [disableAutoEnable=false]
      *     If `true`, do not automatically enable supported IMAP extensions.
      *
+     * @property {Boolean} [disableIMAP4rev2=false]
+     *     If `true`, do not enable IMAP4rev2 mode even if the server supports it.
+     *     Use as a targeted opt-out for servers with broken IMAP4rev2 implementations
+     *     without losing the other auto-enabled extensions.
+     *
      * @property {Number} [connectionTimeout=90000]
      *     Maximum time (in milliseconds) to wait for the connection to establish. Defaults to 90 seconds.
      *
@@ -397,6 +403,14 @@ class ImapFlow extends EventEmitter {
 
         this.disableBinary = !!this.options.disableBinary;
 
+        // Set when the server rejects a LIST RETURN option group, the auxiliary
+        // SPECIAL-USE/CHILDREN return options, or the LSUB command, so later
+        // listings on this connection skip what the server does not support
+        this.skipListSubscribedArg = false;
+        this.skipListStatusArgs = false;
+        this.skipListAuxArgs = false;
+        this.skipLsub = false;
+
         // Named error handler for proper cleanup. Certain error codes represent
         // expected socket/network issues (buffer exhaustion, connection reset, broken pipe,
         // timeout, unreachable host) that just need a silent connection close rather
@@ -568,7 +582,8 @@ class ImapFlow extends EventEmitter {
         // are stored in this.commandParts and sent after server "+" continuations.
         let compiled = await compiler(data, {
             asArray: true,
-            literalMinus: this.capabilities.has('LITERAL-') || this.capabilities.has('LITERAL+')
+            // LITERAL- is part of base IMAP4rev2
+            literalMinus: hasCapability(this, 'LITERAL-') || this.capabilities.has('LITERAL+')
         });
         this.commandParts = compiled;
 
@@ -1053,13 +1068,29 @@ class ImapFlow extends EventEmitter {
         }
 
         if (!this.options.disableAutoEnable) {
-            // enable extensions if possible
-            await this.run('ENABLE', ['CONDSTORE', 'UTF8=ACCEPT'].concat(this.options.qresync ? 'QRESYNC' : []));
+            await this.autoEnable();
         }
 
         this.usable = true;
     }
 
+    // Enable extensions if possible. IMAP4rev2 must be enabled explicitly on
+    // servers that advertise both rev1 and rev2 (RFC 9051 Appendix A); a single
+    // ENABLE call is used so the enabled set is built in one round trip.
+    async autoEnable() {
+        let enableList = ['CONDSTORE', 'UTF8=ACCEPT'].concat(this.options.qresync ? 'QRESYNC' : []).concat(this.options.disableIMAP4rev2 ? [] : 'IMAP4rev2');
+        let enableResult = await this.run('ENABLE', enableList);
+        if (enableResult === false && enableList.includes('IMAP4rev2')) {
+            // RFC 5161 requires servers to ignore unknown ENABLE arguments, but a
+            // broken implementation may reject the whole command over IMAP4rev2 -
+            // retry without it so CONDSTORE/QRESYNC are not lost as collateral
+            await this.run(
+                'ENABLE',
+                enableList.filter(extension => extension !== 'IMAP4rev2')
+            );
+        }
+    }
+
     async compress() {
         if (!(await this.run('COMPRESS'))) {
             return; // was not able to negotiate compression
@@ -2213,7 +2244,7 @@ class ImapFlow extends EventEmitter {
      * @property {Set<string>} flags a set of flags for this mailbox
      * @property {String} specialUse one of special-use flags (if applicable): "\All", "\Archive", "\Drafts", "\Flagged", "\Junk", "\Sent", "\Trash". Additionally INBOX has non-standard "\Inbox" flag set
      * @property {Boolean} listed `true` if mailbox was found from the output of LIST command
-     * @property {Boolean} subscribed `true` if mailbox was found from the output of LSUB command
+     * @property {Boolean} subscribed `true` if the mailbox is subscribed - reported by LSUB or by LIST RETURN (SUBSCRIBED) on LIST-EXTENDED/IMAP4rev2 servers
      * @property {StatusObject} [status] If `statusQuery` was used, then this value includes the status response
      */
 
@@ -2261,9 +2292,10 @@ class ImapFlow extends EventEmitter {
      * @property {Set<string>} flags list of flags for this mailbox
      * @property {String} specialUse one of special-use flags (if applicable): "\All", "\Archive", "\Drafts", "\Flagged", "\Junk", "\Sent", "\Trash". Additionally INBOX has non-standard "\Inbox" flag set
      * @property {Boolean} listed `true` if mailbox was found from the output of LIST command
-     * @property {Boolean} subscribed `true` if mailbox was found from the output of LSUB command
+     * @property {Boolean} subscribed `true` if the mailbox is subscribed - reported by LSUB or by LIST RETURN (SUBSCRIBED) on LIST-EXTENDED/IMAP4rev2 servers
      * @property {Boolean} disabled If `true` then this mailbox can not be selected in the UI
      * @property {ListTreeResponse[]} folders An array of subfolders
+     * @property {StatusObject} [status] If `statusQuery` was used, then this value includes the status response
      */
 
     /**

package/lib/search-compiler.js

@@ -2,7 +2,7 @@
 
 'use strict';
 
-const { formatDate, formatFlag, canUseFlag, isDate } = require('./tools.js');
+const { formatDate, formatFlag, canUseFlag, isDate, isRev2Active } = require('./tools.js');
 
 /**
  * Sets a boolean flag in the IMAP search attributes.
@@ -186,10 +186,24 @@ module.exports.searchCompiler = (connection, query) => {
 
                 // Simple boolean flags without UN- support
                 case 'ALL':
+                    if (params[term]) {
+                        setBoolOpt(attributes, term, true);
+                    }
+                    break;
+
                 case 'NEW':
                 case 'OLD':
                 case 'RECENT':
                     if (params[term]) {
+                        // The \Recent flag and the NEW/OLD/RECENT search keys were
+                        // removed in IMAP4rev2 (RFC 9051) - a rev2 session would
+                        // reject the whole search with a tagged BAD, so fail with a
+                        // descriptive error instead
+                        if (isRev2Active(connection)) {
+                            let error = new Error(`The "${term.toLowerCase()}" search key does not exist in IMAP4rev2`);
+                            error.code = 'MissingServerExtension';
+                            throw error;
+                        }
                         setBoolOpt(attributes, term, true);
                     }
                     break;

package/lib/tools.js

@@ -11,6 +11,34 @@ const iconv = require('iconv-lite');
 
 const FLAG_COLORS = ['red', 'orange', 'yellow', 'green', 'blue', 'purple', 'grey'];
 
+// Upper bound for expanding a single server-supplied sequence range (see
+// expandRange). 2^24 entries is far beyond any legitimate mailbox while keeping
+// the worst-case expansion of a hostile range bounded.
+const EXPANDED_RANGE_LIMIT = 0x1000000;
+
+// Extensions that RFC 9051 (IMAP4rev2) folds into the base protocol (Appendix E).
+// When IMAP4rev2 is active, these are available even without their own capability
+// token. BINARY is deliberately excluded - RFC 9051 only folds in the FETCH side,
+// and the BINARY consumers have safe fallbacks of their own. The set mirrors the
+// Appendix E list in full, including entries no call site consults yet, so any
+// future capability check gets the rev2 folding for free.
+const IMAP4REV2_FOLDED_CAPABILITIES = new Set([
+    'ENABLE',
+    'ESEARCH',
+    'IDLE',
+    'LIST-EXTENDED',
+    'LIST-STATUS',
+    'LITERAL-',
+    'MOVE',
+    'NAMESPACE',
+    'SASL-IR',
+    'SEARCHRES',
+    'SPECIAL-USE',
+    'STATUS=SIZE',
+    'UIDPLUS',
+    'UNSELECT'
+]);
+
 /**
  * Error subclass thrown when IMAP authentication fails.
  */
@@ -19,6 +47,80 @@ class AuthenticationFailure extends Error {
 }
 
 const tools = {
+    /**
+     * Checks whether IMAP4rev2 semantics are active for the connection: either the
+     * client enabled IMAP4rev2 explicitly, or the server is rev2-only (advertises
+     * IMAP4rev2 without IMAP4rev1), in which case rev2 is the base protocol without
+     * any ENABLE (RFC 9051 Appendix A). UTF-8 mailbox names apply in both cases.
+     *
+     * @param {Object} connection - IMAP connection instance
+     * @returns {Boolean} True if IMAP4rev2 semantics apply to this session
+     */
+    isRev2Active(connection) {
+        return connection.enabled.has('IMAP4REV2') || (connection.capabilities.has('IMAP4rev2') && !connection.capabilities.has('IMAP4rev1'));
+    },
+
+    /**
+     * Checks a capability, accounting for extensions that RFC 9051 folds into base
+     * IMAP4rev2. Falls back to the plain capability lookup on IMAP4rev1 sessions,
+     * so behavior against rev1 servers is unchanged.
+     *
+     * @param {Object} connection - IMAP connection instance
+     * @param {String} capability - Capability name, e.g. 'UIDPLUS'
+     * @returns {Boolean} True if the capability (or its rev2-folded equivalent) is available
+     */
+    hasCapability(connection, capability) {
+        if (connection.capabilities.has(capability)) {
+            return true;
+        }
+        return IMAP4REV2_FOLDED_CAPABILITIES.has(capability) && tools.isRev2Active(connection);
+    },
+
+    /**
+     * Builds the attribute list for a STATUS request - the standalone STATUS command
+     * or the LIST-STATUS return option - from a status query object. Items the current
+     * session cannot request (RECENT under IMAP4rev2, HIGHESTMODSEQ without CONDSTORE)
+     * are silently dropped.
+     *
+     * @param {Object} connection - IMAP connection instance
+     * @param {Object} statusQuery - Status data items to request, e.g. {messages: true}
+     * @returns {Object[]} Attribute token list for the command compiler
+     */
+    buildStatusQueryAttributes(connection, statusQuery) {
+        let attributes = [];
+
+        Object.keys(statusQuery || {}).forEach(key => {
+            if (!statusQuery[key]) {
+                return;
+            }
+
+            switch (key.toUpperCase()) {
+                case 'MESSAGES':
+                case 'UIDNEXT':
+                case 'UIDVALIDITY':
+                case 'UNSEEN':
+                    attributes.push({ type: 'ATOM', value: key.toUpperCase() });
+                    break;
+
+                case 'RECENT':
+                    // RECENT was removed in IMAP4rev2 (RFC 9051) - requesting it from a
+                    // rev2 session would get the whole STATUS request rejected
+                    if (!tools.isRev2Active(connection)) {
+                        attributes.push({ type: 'ATOM', value: key.toUpperCase() });
+                    }
+                    break;
+
+                case 'HIGHESTMODSEQ':
+                    if (connection.capabilities.has('CONDSTORE')) {
+                        attributes.push({ type: 'ATOM', value: key.toUpperCase() });
+                    }
+                    break;
+            }
+        });
+
+        return attributes;
+    },
+
     /**
      * Encodes a mailbox path to modified UTF-7 if the server does not support UTF8=ACCEPT.
      *
@@ -28,7 +130,7 @@ const tools = {
      */
     encodePath(connection, path) {
         path = (path || '').toString();
-        if (!connection.enabled.has('UTF8=ACCEPT') && /[&\x00-\x08\x0b-\x0c\x0e-\x1f\u0080-\uffff]/.test(path)) {
+        if (!connection.enabled.has('UTF8=ACCEPT') && !tools.isRev2Active(connection) && /[&\x00-\x08\x0b-\x0c\x0e-\x1f\u0080-\uffff]/.test(path)) {
             try {
                 path = iconv.encode(path, 'utf-7-imap').toString();
             } catch {
@@ -47,7 +149,7 @@ const tools = {
      */
     decodePath(connection, path) {
         path = (path || '').toString();
-        if (!connection.enabled.has('UTF8=ACCEPT') && /[&]/.test(path)) {
+        if (!connection.enabled.has('UTF8=ACCEPT') && !tools.isRev2Active(connection) && /[&]/.test(path)) {
             try {
                 path = iconv.decode(Buffer.from(path), 'utf-7-imap').toString();
             } catch {
@@ -120,6 +222,11 @@ const tools = {
                     return;
                 }
 
+                if (capability === 'IMAP4REV2') {
+                    map.set('IMAP4rev2', true);
+                    return;
+                }
+
                 if (capability.startsWith('APPENDLIMIT=')) {
                     let splitPos = capability.indexOf('=');
                     let appendLimit = Number(capability.substr(splitPos + 1)) || 0;
@@ -222,7 +329,7 @@ const tools = {
                 existing.path = folder.path;
                 existing.subscribed = !!folder.subscribed;
                 existing.listed = !!folder.listed;
-                existing.status = !!folder.status;
+                existing.status = folder.status;
 
                 if (folder.specialUse) {
                     existing.specialUse = folder.specialUse;
@@ -242,7 +349,7 @@ const tools = {
                     path: folder.path,
                     subscribed: !!folder.subscribed,
                     listed: !!folder.listed,
-                    status: !!folder.status
+                    status: folder.status
                 };
 
                 if (folder.delimiter) {
@@ -1016,9 +1123,28 @@ const tools = {
         return !mailbox || !mailbox.permanentFlags || mailbox.permanentFlags.has('\\*') || mailbox.permanentFlags.has(flag);
     },
 
+    /**
+     * Checks that a value is a valid IMAP sequence number or UID: a non-zero
+     * 32-bit unsigned integer (nz-number in the RFC 9051 grammar). Guards range
+     * expansion against untrusted server input such as 'Infinity' or '0:*'.
+     *
+     * @param {Number} value - Value to check
+     * @returns {Boolean} True if the value is a valid sequence number/UID
+     */
+    isValidSequenceValue(value) {
+        return Number.isSafeInteger(value) && value > 0 && value <= 0xffffffff;
+    },
+
     /**
      * Expands an IMAP sequence range string (e.g. "1:3,5,7:9") into an array of numbers.
      *
+     * Entries with endpoints that are not valid nz-numbers are skipped - the input
+     * may come from an untrusted server, and 'Infinity' or similar garbage would
+     * otherwise loop without bound. A single range is expanded to at most
+     * EXPANDED_RANGE_LIMIT entries: legitimate responses never reach the limit
+     * (the mailbox would need that many messages), while a hostile range like
+     * 1:4294967295 is cut off instead of exhausting memory.
+     *
      * @param {String} range - IMAP sequence range string
      * @returns {Number[]} Array of expanded sequence numbers
      */
@@ -1027,20 +1153,26 @@ const tools = {
             entry = entry.trim();
             let colon = entry.indexOf(':');
             if (colon < 0) {
-                return Number(entry) || 0;
+                let value = Number(entry);
+                return tools.isValidSequenceValue(value) ? value : [];
+            }
+            let first = Number(entry.substr(0, colon));
+            let second = Number(entry.substr(colon + 1));
+            if (!tools.isValidSequenceValue(first) || !tools.isValidSequenceValue(second)) {
+                return [];
             }
-            let first = Number(entry.substr(0, colon)) || 0;
-            let second = Number(entry.substr(colon + 1)) || 0;
             if (first === second) {
                 return first;
             }
             let list = [];
             if (first < second) {
-                for (let i = first; i <= second; i++) {
+                let last = Math.min(second, first + EXPANDED_RANGE_LIMIT - 1);
+                for (let i = first; i <= last; i++) {
                     list.push(i);
                 }
             } else {
-                for (let i = first; i >= second; i--) {
+                let last = Math.max(second, first - EXPANDED_RANGE_LIMIT + 1);
+                for (let i = first; i >= last; i--) {
                     list.push(i);
                 }
             }

package/package.json

@@ -1,12 +1,13 @@
 {
     "name": "imapflow",
-    "version": "1.4.8",
+    "version": "1.4.9",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",
     "scripts": {
         "test": "grunt",
         "coverage": "c8 --reporter=text --reporter=html npx nodeunit test/*-test.js",
+        "test:rev2": "bash test/integration/run-rev2-tests.sh",
         "update": "rm -rf node_modules package-lock.json && ncu -u && npm install",
         "format": "prettier --write \"**/*.{js,json,md,yml,yaml}\" --ignore-path .prettierignore",
         "lint": "eslint ."
@@ -37,7 +38,7 @@
         "grunt-cli": "1.5.0",
         "grunt-contrib-nodeunit": "5.0.0",
         "grunt-eslint": "26.0.0",
-        "prettier": "3.9.5",
+        "prettier": "3.9.6",
         "proxyquire": "^2.1.3",
         "typescript": "7.0.2"
     },

package/test/commands-branches-test.js

@@ -415,7 +415,7 @@ module.exports['Branches: search with undefined options uses {} fallback'] = asy
 // operand of the OR is evaluated and used to skip it.
 // ============================================================================
 
-module.exports['Branches: search ESEARCH without uid emits SEARCH and skips LIST-typed tag'] = async test => {
+module.exports['Branches: search ESEARCH without uid emits SEARCH and skips the tag correlator'] = async test => {
     let execCmd = null;
     const connection = createMockConnection({
         state: 3,
@@ -423,10 +423,17 @@ module.exports['Branches: search ESEARCH without uid emits SEARCH and skips LIST
         exec: async (cmd, attrs, opts) => {
             execCmd = cmd;
             if (opts && opts.untagged && opts.untagged.ESEARCH) {
-                // attrs[0] is a LIST-typed object (not a plain Array) -> exercises
-                // the `attrs[start].type === 'LIST'` branch on line 150.
+                // attrs[0] is the (TAG "...") correlator group, represented by the
+                // parser as a plain Array - it must be skipped before the keywords
                 await opts.untagged.ESEARCH({
-                    attributes: [{ type: 'LIST' }, { type: 'ATOM', value: 'COUNT' }, { type: 'ATOM', value: '7' }]
+                    attributes: [
+                        [
+                            { type: 'ATOM', value: 'TAG' },
+                            { type: 'STRING', value: 'A1' }
+                        ],
+                        { type: 'ATOM', value: 'COUNT' },
+                        { type: 'ATOM', value: '7' }
+                    ]
                 });
             }
             return { next: () => {} };