imapflow 1.6.3 → 1.6.5

package/test/imap-compiler-test.js

@@ -639,3 +639,171 @@ module.exports['IMAP Compiler: partial range in SECTION'] = test =>
         ).toString();
         test.ok(compiled.includes('<0.50>'), 'should contain partial range <0.50>');
     });
+
+// Returns the error a compile attempt raised, or undefined when it succeeded.
+// Several cases below assert that a token can never reach the wire, and the
+// try/catch is the only interesting part of each. Takes either an attributes
+// array (compiled under a default tag/command) or a full response object.
+const compileError = async input => {
+    try {
+        await compiler(Array.isArray(input) ? { tag: 'A', command: 'CMD', attributes: input } : input);
+    } catch (err) {
+        return err;
+    }
+};
+
+module.exports['IMAP Compiler: SEQUENCE rejects values that are not sequence sets'] = test =>
+    asyncWrapper(test, async test => {
+        // Sequence sets are written verbatim, so a range string that reached the
+        // compiler unvalidated would put a second command on the wire
+        for (let value of ['1\r\nZZ1 LOGOUT', '1 2', '1;2', 'ALL', '1:2)', '1\t2', Buffer.from('1\r\nZZ NOOP')]) {
+            let err = await compileError([{ type: 'SEQUENCE', value }]);
+            test.equal(err && err.code, 'InvalidSequenceSet', `${JSON.stringify(value.toString())} must be rejected`);
+        }
+    });
+
+module.exports['IMAP Compiler: SEQUENCE accepts every valid sequence-set form'] = test =>
+    asyncWrapper(test, async test => {
+        // '$' is the RFC 5182 SEARCHRES saved-result marker, valid as the entire set
+        for (let value of ['1', '*', '1:*', '*:1', '1,3,5', '1:3,7,9:*', '4294967295', '$']) {
+            const compiled = (await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'SEQUENCE', value }] })).toString();
+            test.equal(compiled, `A FETCH ${value}`);
+        }
+
+        // '$' only stands for the whole set, never an element of one
+        for (let value of ['$,1', '1,$', '$:2']) {
+            let err = await compileError([{ type: 'SEQUENCE', value }]);
+            test.equal(err && err.code, 'InvalidSequenceSet', `${JSON.stringify(value)} must be rejected`);
+        }
+    });
+
+module.exports['IMAP Compiler: SEQUENCE validation stays linear on huge valid sets'] = test =>
+    asyncWrapper(test, async test => {
+        // The regex this replaced overflowed the engine's backtrack stack with an
+        // uncoded RangeError at roughly a million comma-separated elements - a set
+        // a fetch over a large mailbox can legitimately produce
+        const huge = Array.from({ length: 1500000 }, (_, i) => i + 1).join(',');
+        const compiled = await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'SEQUENCE', value: huge }] });
+        test.ok(compiled.toString().endsWith(huge), 'the huge but valid set must compile');
+    });
+
+module.exports['IMAP Compiler: SEQUENCE validation is skipped when logging'] = test =>
+    asyncWrapper(test, async test => {
+        // The incoming token parser accepts sequence-shaped tokens the strict grammar
+        // rejects (an ESEARCH set like "1:2:3", a folder name like "12:30:00"). Every
+        // parsed server response is re-compiled for the log, so a throw here would let
+        // one quirky server line kill the whole connection.
+        for (let value of ['1:2:3', '12:30:00', '1,2:3:4']) {
+            const compiled = (await compiler({ tag: '*', command: 'OK', attributes: [{ type: 'SEQUENCE', value }] }, { isLogging: true })).toString();
+            test.equal(compiled, `* OK ${value}`, 'logging re-compile must pass the token through');
+        }
+    });
+
+module.exports['IMAP Compiler: tag and command cannot carry a line terminator'] = test =>
+    asyncWrapper(test, async test => {
+        // The tag/command preamble is written verbatim ahead of any token, so it goes
+        // through the same choke point as everything else
+        let err = await compileError({ tag: 'A\r\nZZ LOGOUT', command: 'NOOP' });
+        test.equal(err && err.code, 'InvalidTokenValue', 'CRLF in the tag must be rejected');
+
+        err = await compileError({ tag: 'A', command: 'NOOP\r\nZZ LOGOUT' });
+        test.equal(err && err.code, 'InvalidTokenValue', 'CRLF in the command must be rejected');
+    });
+
+module.exports['IMAP Compiler: quoted strings use IMAP escaping, not JSON escaping'] = test =>
+    asyncWrapper(test, async test => {
+        // Only DQUOTE and backslash have escapes in the IMAP grammar - a tab must
+        // survive as a raw byte rather than becoming a literal backslash-t
+        const compiled = (await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'STRING', value: 'a\tb"c\\d' }] })).toString();
+        test.equal(compiled, 'A CMD "a\tb\\"c\\\\d"');
+    });
+
+module.exports['IMAP Compiler: quoted strings reject CR, LF and NUL'] = test =>
+    asyncWrapper(test, async test => {
+        for (let value of ['a\rb', 'a\nb', 'a\0b']) {
+            let err = await compileError([{ type: 'STRING', value }]);
+            test.equal(err && err.code, 'InvalidStringValue', `${JSON.stringify(value)} cannot be sent as a quoted string`);
+        }
+    });
+
+module.exports['IMAP Compiler: a mailbox name with CRLF cannot reach the wire'] = test =>
+    asyncWrapper(test, async test => {
+        // Paths travel as ATOM tokens and get quoted when they fall outside ATOM-CHAR
+        let err = await compileError([{ type: 'ATOM', value: 'INBOX\r\nZZ LOGOUT' }]);
+        test.equal(err && err.code, 'InvalidStringValue');
+    });
+
+module.exports['IMAP Compiler: response text cannot carry a line terminator'] = test =>
+    asyncWrapper(test, async test => {
+        // TEXT is written verbatim as well, so it gets the same guarantee even though
+        // only the parser produces it today
+        let err = await compileError([{ type: 'TEXT', value: 'oops\r\nZZ NOOP' }]);
+        test.equal(err && err.code, 'InvalidTextValue');
+    });
+
+module.exports['IMAP Compiler: NUMBER coerces its value instead of writing it through'] = test =>
+    asyncWrapper(test, async test => {
+        const compiled = (await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value: '1\r\nZZ NOOP' }] })).toString();
+        test.equal(compiled, 'A CMD 0', 'a non-numeric value must not reach the wire verbatim');
+        test.equal((await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value: '42' }] })).toString(), 'A CMD 42');
+    });
+
+module.exports['IMAP Compiler: numeric tokens clamp to bounded non-negative integers'] = test =>
+    asyncWrapper(test, async test => {
+        // Infinity, negatives and unsafe magnitudes would otherwise emit bytes outside
+        // the number alphabet ("Infinity", "-5", "1e+300") and get a server BAD blamed
+        // on the server instead of the caller
+        for (let [value, expected] of [
+            [Infinity, '0'],
+            ['Infinity', '0'],
+            [-5, '0'],
+            ['2e21', '0'],
+            [4.6, '5']
+        ]) {
+            const compiled = (await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value }] })).toString();
+            test.equal(compiled, `A CMD ${expected}`, `${JSON.stringify(value)} must clamp to ${expected}`);
+        }
+    });
+
+module.exports['IMAP Compiler: partial range coerces its elements'] = test =>
+    asyncWrapper(test, async test => {
+        // The partial range is the last token component written verbatim, so it is
+        // coerced rather than joined as-is
+        const attributes = [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: ['0>\r\nZZ NOOP'] }];
+        const compiled = (await compiler({ tag: 'A', command: 'FETCH', attributes })).toString();
+        test.equal(compiled, 'A FETCH BODY.PEEK[]<0>');
+
+        const normal = (
+            await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: [0, 1024] }] })
+        ).toString();
+        test.equal(normal, 'A FETCH BODY.PEEK[]<0.1024>');
+
+        // Floats and unbounded numerics clamp the same way NUMBER tokens do, so no
+        // non-digit byte ("512.5", "Infinity") can appear inside the partial range
+        const float = (
+            await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: [0, 512.5] }] })
+        ).toString();
+        test.equal(float, 'A FETCH BODY.PEEK[]<0.513>');
+
+        const unbounded = (
+            await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: ['Infinity', '2e21'] }] })
+        ).toString();
+        test.equal(unbounded, 'A FETCH BODY.PEEK[]<0.0>');
+    });
+
+module.exports['IMAP Compiler: logging output never throws on unsendable values'] = test =>
+    asyncWrapper(test, async test => {
+        // The logging pass must survive whatever the wire pass refuses, so a rejected
+        // command can still be logged
+        const compiled = (
+            await compiler(
+                {
+                    tag: 'A',
+                    command: 'LOGIN',
+                    attributes: [{ type: 'STRING', value: 'a\r\nb' }]
+                },
+                { isLogging: true }
+            )
+        ).toString();
+        test.ok(compiled.includes('\\r\\n'), 'control characters stay escaped for the log');
+    });

package/test/imap-flow-internals-test.js

@@ -471,3 +471,137 @@ module.exports['Internals: untaggedFetch includes modseq and flagColor'] = async
     test.equal(evt.flagColor, 'red');
     test.done();
 };
+
+// ============================================================================
+// runInternal dispatch guards
+// ============================================================================
+
+module.exports['Internals: runInternal returns false for unknown command'] = async test => {
+    let client = makeClient();
+    client.socket = { destroyed: false };
+    let res = await client.runInternal('NOT_A_COMMAND');
+    test.equal(res, false);
+    test.done();
+};
+
+module.exports['Internals: runInternal throws NoConnection when the socket is destroyed'] = async test => {
+    let client = makeClient();
+    client.socket = { destroyed: true };
+    let err = null;
+    try {
+        await client.runInternal('NOOP');
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err);
+    test.equal(err.code, 'NoConnection');
+    test.done();
+};
+
+// ============================================================================
+// send() onSend error containment
+// ============================================================================
+
+module.exports['Internals: send contains a throwing onSend callback'] = async test => {
+    let client = makeClient();
+    let written = [];
+    let warnings = [];
+    client.socket = { destroyed: false };
+    client.writeSocket = { destroyed: false, write: chunk => written.push(chunk) };
+    client.state = client.states.AUTHENTICATED;
+    client.log.warn = entry => warnings.push(entry);
+    client.currentRequest = { tag: 'A1', sent: false };
+
+    // The command is already on the wire when onSend runs, so a throwing callback
+    // must be logged and swallowed instead of rejecting the request
+    await client.send({
+        tag: 'A1',
+        command: 'NOOP',
+        attributes: [],
+        options: {
+            onSend: () => {
+                throw new Error('onSend boom');
+            }
+        }
+    });
+
+    test.equal(written.length, 1, 'the command was written to the socket');
+    test.equal(written[0].toString(), 'A1 NOOP\r\n', 'the actual wire bytes went out before onSend ran');
+    test.equal(client.currentRequest.sent, true, 'the request is marked as sent');
+    test.ok(
+        warnings.some(entry => entry && entry.err && entry.err.message === 'onSend boom'),
+        'the callback error was logged'
+    );
+    test.done();
+};
+
+// ============================================================================
+// countUnknownTag teardown guard
+// ============================================================================
+
+module.exports['Internals: countUnknownTag ignores tags on a closed connection'] = test => {
+    let client = makeClient();
+    client.isClosed = true;
+    client.countUnknownTag('A1');
+    test.equal(client._unknownTagCount, 0, 'teardown crossover is not counted');
+    test.done();
+};
+
+// ============================================================================
+// rejectUnparsedCompletion
+// ============================================================================
+
+// Installs a command that is current and on the wire, returning a holder for
+// the rejection the reader loop would deliver to the caller
+const armInFlight = (client, tag) => {
+    let captured = { err: null };
+    client.currentRequest = { tag, sent: true };
+    client.requestTagMap.set(tag, {
+        tag,
+        reject: err => {
+            captured.err = err;
+        }
+    });
+    return captured;
+};
+
+module.exports['Internals: rejectUnparsedCompletion ignores lines without an in-flight command'] = test => {
+    let client = makeClient();
+
+    client.currentRequest = false;
+    client.rejectUnparsedCompletion(Buffer.from('A1 OK done'), new Error('parse fail'));
+    test.equal(client.currentRequest, false, 'no request to settle');
+
+    // A command that is current but not yet on the wire must not be settled either
+    client.currentRequest = { tag: 'A1', sent: false };
+    client.rejectUnparsedCompletion(Buffer.from('A1 OK done'), new Error('parse fail'));
+    test.ok(client.currentRequest, 'the unsent request is untouched');
+    test.done();
+};
+
+module.exports['Internals: rejectUnparsedCompletion recovers the tag from NUL-padded raw bytes'] = async test => {
+    let client = makeClient();
+    let captured = armInFlight(client, 'A1');
+
+    // The parser died before extracting a tag - the raw line carries the buggy-server
+    // NUL padding, so the fallback must skip it and stop at the first non-tag byte
+    let parserError = new Error('parse fail');
+    client.rejectUnparsedCompletion(Buffer.from('\x00\x00A1 \x07garbage'), parserError);
+
+    test.ok(captured.err, 'the in-flight command was failed');
+    test.equal(captured.err.code, 'ParserError');
+    test.equal(captured.err.parserError, parserError);
+    test.equal(client.currentRequest, false, 'the request slot was cleared');
+    test.done();
+};
+
+module.exports['Internals: rejectUnparsedCompletion ignores a mismatched raw tag'] = test => {
+    let client = makeClient();
+    let captured = armInFlight(client, 'A1');
+
+    client.rejectUnparsedCompletion(Buffer.from('A2 NO other'), new Error('parse fail'));
+
+    test.equal(captured.err, null, 'a line for another tag settles nothing');
+    test.ok(client.currentRequest, 'the in-flight request stays current');
+    test.done();
+};

package/test/imap-flow-secure-test.js

@@ -75,37 +75,48 @@ const lineReader = (sock, onLine) => {
 
 const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', () => resolve(server.address().port)));
 
-// ---------------------------------------------------------------------------
-// STARTTLS happy path
-// ---------------------------------------------------------------------------
-
-module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
-    let server = net.createServer(rawSocket => {
+// Builds a STARTTLS mock server. Defaults give the happy path; options tweak a
+// phase without another copy of the upgrade scaffold:
+// - preTlsCaps / postTlsCaps: capability list advertised before / after the upgrade
+// - startTlsOk: tag => string, overrides the response line to the STARTTLS command
+// - onTlsLine: (tlsSocket, line) => boolean, intercepts post-upgrade lines; return
+//   true when the line was handled
+const createStartTlsServer = (opts = {}) =>
+    net.createServer(rawSocket => {
         rawSocket.on('error', () => {});
 
+        let preTlsCaps = opts.preTlsCaps || `${CAPS} STARTTLS`;
+        let postTlsCaps = opts.postTlsCaps || CAPS;
+
         let detachPlain;
         detachPlain = lineReader(rawSocket, line => {
-            handleLine(
-                rawSocket,
-                line,
-                () => {
-                    // Upgrade: stop reading plaintext, wrap the socket in TLS
-                    detachPlain();
-                    let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                    tlsSocket.on('error', () => {});
-                    tlsSocket.on('secure', () => {});
-                    // post-TLS phase advertises a different capability set
-                    lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, `${CAPS} POSTTLS-ONLY`));
-                },
-                `${CAPS} STARTTLS PRETLS-ONLY`
-            );
+            let parts = line.split(' ');
+            let tag = parts[0];
+            let cmd = (parts[1] || '').toUpperCase();
+
+            if (cmd === 'STARTTLS') {
+                rawSocket.write(opts.startTlsOk ? opts.startTlsOk(tag) : `${tag} OK Begin TLS\r\n`);
+                detachPlain();
+                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
+                tlsSocket.on('error', () => {});
+                lineReader(tlsSocket, l => {
+                    if (opts.onTlsLine && opts.onTlsLine(tlsSocket, l)) {
+                        return;
+                    }
+                    handleLine(tlsSocket, l, null, postTlsCaps);
+                });
+                return;
+            }
+
+            handleLine(rawSocket, line, null, preTlsCaps);
         });
 
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS PRETLS-ONLY] ready\r\n`);
+        rawSocket.write(`* OK [CAPABILITY ${preTlsCaps}] ready\r\n`);
     });
 
-    let port = await listen(server);
-    let client = new ImapFlow({
+// The client options shared by every STARTTLS test.
+const makeStartTlsClient = (port, overrides = {}) =>
+    new ImapFlow({
         host: '127.0.0.1',
         port,
         secure: false,
@@ -115,8 +126,30 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
         disableAutoIdle: true,
         disableCompression: true,
         logger: false,
-        auth: { user: 'test', pass: 'secret' }
+        auth: { user: 'test', pass: 'secret' },
+        ...overrides
+    });
+
+// Every terminal upgrade path must leave no upgrade state behind
+const assertUpgradeSettled = (test, client) => {
+    test.equal(client.upgrading, false, 'upgrading flag cleared');
+    test.equal(client._upgradeReject, null, 'upgrade rejector cleared');
+    test.equal(client.upgradeTimeout, null, 'upgrade timer cleared');
+};
+
+// ---------------------------------------------------------------------------
+// STARTTLS happy path
+// ---------------------------------------------------------------------------
+
+module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
+    // post-TLS phase advertises a different capability set
+    let server = createStartTlsServer({
+        preTlsCaps: `${CAPS} STARTTLS PRETLS-ONLY`,
+        postTlsCaps: `${CAPS} POSTTLS-ONLY`
     });
+
+    let port = await listen(server);
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     await client.connect();
@@ -135,24 +168,69 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
     test.done();
 };
 
-// Builds the STARTTLS happy-path server used by the watchdog and cleanup tests below.
-const createStartTlsServer = () =>
-    net.createServer(rawSocket => {
-        rawSocket.on('error', () => {});
+module.exports['Secure: STARTTLS discards capabilities even when the OK carries a CAPABILITY code'] = async test => {
+    // A server (or a MITM rewriting the plaintext stream) may stamp [CAPABILITY ...]
+    // on the STARTTLS OK itself. That marks the capability set as freshly updated, so
+    // a discard conditioned on "an update is still pending" would keep exactly the
+    // pre-TLS list an attacker controls - the list that then chooses the AUTH
+    // mechanism and answers LOGINDISABLED. RFC 9051 6.2.1 makes the discard mandatory.
+    let server = createStartTlsServer({
+        preTlsCaps: `${CAPS} STARTTLS PRETLS-ONLY`,
+        postTlsCaps: `${CAPS} POSTTLS-ONLY`,
+        // the OK itself carries a (pre-TLS, attacker-rewritable) CAPABILITY code
+        startTlsOk: tag => `${tag} OK [CAPABILITY ${CAPS} PRETLS-ONLY] Begin TLS\r\n`
+    });
 
-        let detachPlain;
-        detachPlain = lineReader(rawSocket, line => {
-            handleLine(rawSocket, line, () => {
-                detachPlain();
-                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                tlsSocket.on('error', () => {});
-                lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, CAPS));
-            });
-        });
+    let port = await listen(server);
+    let client = makeStartTlsClient(port);
+    client.on('error', () => {});
 
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
+    await client.connect();
+    test.ok(client.secureConnection, 'connection upgraded to TLS');
+    test.ok(client.capabilities.has('POSTTLS-ONLY'), 'post-TLS capabilities were re-fetched');
+    test.ok(!client.capabilities.has('PRETLS-ONLY'), 'pre-TLS capabilities were discarded');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Secure: pre-TLS rawCapabilities do not survive a failed re-fetch'] = async test => {
+    // capabilities/authCapabilities are discarded at the upgrade, but rawCapabilities
+    // is public surface external consumers read. If the post-TLS CAPABILITY re-fetch
+    // fails, the pre-TLS list - the one an active attacker can rewrite - must not
+    // linger there either.
+    let server = createStartTlsServer({
+        preTlsCaps: `${CAPS} STARTTLS PRETLS-ONLY`,
+        postTlsCaps: `${CAPS} POSTTLS-ONLY`,
+        onTlsLine: (tlsSocket, line) => {
+            let parts = line.split(' ');
+            if ((parts[1] || '').toUpperCase() === 'CAPABILITY') {
+                // the re-fetch over TLS fails
+                tlsSocket.write(`${parts[0]} NO CAPABILITY not available\r\n`);
+                return true;
+            }
+            return false;
+        }
     });
 
+    let port = await listen(server);
+    let client = makeStartTlsClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.secureConnection, 'connection upgraded to TLS');
+    test.ok(!client.capabilities.has('PRETLS-ONLY'), 'pre-TLS capabilities were discarded');
+    let raw = [].concat(client.rawCapabilities || []);
+    test.ok(!raw.some(entry => entry && /PRETLS-ONLY/.test(entry.value || entry)), 'pre-TLS rawCapabilities were discarded');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
 // Records every socket that went through configureSocket(), which is the single place the
 // transport options (keepalive + inactivity watchdog) are applied.
 const trackConfiguredSockets = client => {
@@ -171,19 +249,7 @@ module.exports['Secure: STARTTLS session keeps the inactivity watchdog'] = async
     // and a dead connection was never noticed.
     let server = createStartTlsServer();
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        socketTimeout: 200,
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port, { socketTimeout: 200 });
 
     let errors = [];
     client.on('error', err => errors.push(err));
@@ -215,25 +281,12 @@ module.exports['Secure: STARTTLS leaves no upgrade state behind on success'] = a
     // a successful handshake no timer, rejector, flag or temporary handler survives.
     let server = createStartTlsServer();
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     await client.connect();
 
-    test.equal(client.upgrading, false, 'upgrading flag cleared');
-    test.equal(client._upgradeReject, null, 'upgrade rejector cleared');
-    test.equal(client.upgradeTimeout, null, 'upgrade timer cleared');
+    assertUpgradeSettled(test, client);
     // The handshake-only handler is gone, leaving the generic socket error handler as the single
     // error path (during the handshake it is the other way round, which is what prevents a
     // handshake error from firing two handlers at once).
@@ -258,18 +311,7 @@ module.exports['Secure: close() during a STARTTLS upgrade settles the upgrade']
         rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
     });
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     let connectResult = client.connect().then(
@@ -281,15 +323,46 @@ module.exports['Secure: close() during a STARTTLS upgrade settles the upgrade']
     while (!client.upgrading) {
         await new Promise(resolve => setTimeout(resolve, 10));
     }
+    // A late socket event would invoke the same settle helper the rejector exposes -
+    // capture it before close() consumes it
+    let settle = client._upgradeReject;
     client.close();
 
     let err = await connectResult;
     test.ok(err, 'connect rejected rather than hanging on the abandoned upgrade');
     test.ok(['ClosedAfterConnectText', 'ClosedAfterConnectTLS', 'NoConnection'].includes(err.code), `connect rejected with ${err.code}`);
-    test.equal(client.upgrading, false, 'upgrading flag cleared');
-    test.equal(client._upgradeReject, null, 'upgrade rejector cleared');
-    test.equal(client.upgradeTimeout, null, 'upgrade timer cleared');
+    assertUpgradeSettled(test, client);
+
+    // The late event lands after the upgrade already settled - it must be a no-op:
+    // a settled upgrade neither claims the error as a TLS failure nor re-arms any state
+    let lateErr = new Error('late socket error');
+    settle(lateErr);
+    test.ok(!lateErr.tlsFailed, 'the late error was not marked as a TLS upgrade failure');
+    assertUpgradeSettled(test, client);
+
+    server.close();
+    test.done();
+};
+
+module.exports['Secure: STARTTLS handshake failure rejects connect'] = async test => {
+    let server = createStartTlsServer();
+    let port = await listen(server);
+    // The tls option is erased entirely, not merely relaxed: certificate validation
+    // stays on, so the mock server's self-signed certificate must fail the handshake,
+    // and the upgrade builds its TLS options from the no-options fallback
+    let client = makeStartTlsClient(port, { tls: undefined });
+    client.on('error', () => {});
+
+    let err = await client.connect().then(
+        () => null,
+        connectErr => connectErr
+    );
 
+    test.ok(err, 'connect rejected on the failed handshake');
+    test.ok(err.tlsFailed, 'the error is marked as a TLS upgrade failure');
+    assertUpgradeSettled(test, client);
+
+    client.close();
     server.close();
     test.done();
 };