imapflow 1.6.4 → 1.6.5

package/lib/search-compiler.js

@@ -30,6 +30,17 @@ let setBoolOpt = (attributes, term, value) => {
     attributes.push({ type: 'ATOM', value: term.toUpperCase() });
 };
 
+/**
+ * Normalizes a user-supplied sequence set (string, number, bigint, or an array of
+ * them) into the single string value of a SEQUENCE token. An array is one
+ * comma-joined set: separate tokens would be parsed by the server as extra
+ * sequence-number search keys ANDed to the query, not as part of the set.
+ *
+ * @param {*} value - The sequence set value(s)
+ * @returns {string} The joined sequence set string
+ */
+let toSequenceValue = value => [].concat(value).join(',');
+
 /**
  * Adds a search option with its value(s) to the attributes array.
  * Handles NOT operations and array values.
@@ -37,23 +48,20 @@ let setBoolOpt = (attributes, term, value) => {
  * @param {Array} attributes - Array to append the attribute to
  * @param {string} term - The search term (e.g., 'FROM', 'SUBJECT')
  * @param {*} value - The value for the search term (string, array, or falsy for NOT)
- * @param {string} [type='ATOM'] - The attribute type
  */
-let setOpt = (attributes, term, value, type) => {
-    type = type || 'ATOM';
-
+let setOpt = (attributes, term, value) => {
     // Handle NOT operations for false or null values
     if (value === false || value === null) {
-        attributes.push({ type, value: 'NOT' });
+        attributes.push({ type: 'ATOM', value: 'NOT' });
     }
 
-    attributes.push({ type, value: term.toUpperCase() });
+    attributes.push({ type: 'ATOM', value: term.toUpperCase() });
 
-    // Handle array values (e.g., multiple UIDs)
+    // Handle array values (e.g. HEADER name/value pairs)
     if (Array.isArray(value)) {
-        value.forEach(entry => attributes.push({ type, value: (entry || '').toString() }));
+        value.forEach(entry => attributes.push({ type: 'ATOM', value: (entry || '').toString() }));
     } else {
-        attributes.push({ type, value: value.toString() });
+        attributes.push({ type: 'ATOM', value: value.toString() });
     }
 };
 
@@ -158,12 +166,12 @@ module.exports.searchCompiler = (connection, query) => {
                 // Custom sequence range support (non-standard)
                 case 'SEQ':
                     {
-                        let value = params[term];
-                        if (typeof value === 'number') {
-                            value = value.toString();
-                        }
-                        // Only accept valid sequence strings (no whitespace)
-                        if (typeof value === 'string' && /^\S+$/.test(value)) {
+                        // Passed through as a SEQUENCE token: the compiler validates the
+                        // set grammar and throws a coded error. An invalid value used to
+                        // be dropped silently here, which turned a bad filter into an
+                        // unrestricted search that matched every message.
+                        let value = params[term] || params[term] === 0 ? toSequenceValue(params[term]) : '';
+                        if (value) {
                             attributes.push({ type: 'SEQUENCE', value });
                         }
                     }
@@ -239,7 +247,7 @@ module.exports.searchCompiler = (connection, query) => {
                 case 'UID':
                     if (params[term]) {
                         attributes.push({ type: 'ATOM', value: 'UID' });
-                        [].concat(params[term]).forEach(entry => attributes.push({ type: 'SEQUENCE', value: (entry ?? '').toString() }));
+                        attributes.push({ type: 'SEQUENCE', value: toSequenceValue(params[term]) });
                     }
                     break;
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.6.4",
+    "version": "1.6.5",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",

package/test/commands-integration-test.js

@@ -2910,6 +2910,40 @@ module.exports['Commands: compress handles error'] = async test => {
     test.done();
 };
 
+module.exports['Commands: compress fails the connection on trailing data'] = async test => {
+    // Per RFC 4978 the server switches to DEFLATE at its tagged OK, so data already
+    // buffered behind the OK was consumed as cleartext and the deflate stream is
+    // truncated. Declining the upgrade is not a protocol option at that point - the
+    // session is unrecoverable in both directions and must fail closed.
+    let closeAfterCalled = false;
+    let nextCalled = false;
+    const connection = createMockConnection({
+        capabilities: new Map([['COMPRESS=DEFLATE', true]]),
+        closeAfter: () => {
+            closeAfterCalled = true;
+        },
+        exec: async () => ({
+            hasTrailingData: true,
+            next: () => {
+                nextCalled = true;
+                test.ok(closeAfterCalled, 'teardown must be scheduled before parser backpressure is released');
+            }
+        })
+    });
+
+    let err = null;
+    try {
+        await compressCommand(connection);
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err, 'compress must throw');
+    test.equal(err && err.code, 'COMPRESS_TRAILING_DATA');
+    test.ok(closeAfterCalled, 'the connection must be closed');
+    test.ok(nextCalled, 'parser backpressure must still be released');
+    test.done();
+};
+
 // ============================================
 // STARTTLS Command Tests
 // ============================================
@@ -3895,6 +3929,52 @@ module.exports['Commands: list runs separate INBOX query when using namespace']
     test.done();
 };
 
+module.exports['Commands: list INBOX fixup propagates non-reducible failures'] = async test => {
+    // Both sides of the fixup's retry guard: a NO on the extended call is an operational
+    // failure (not a RETURN options rejection), and a BAD on a call that already ran plain
+    // has no options left to reduce - neither may trigger the plain retry
+    for (let { capabilities, status } of [
+        {
+            capabilities: [
+                ['IMAP4rev1', true],
+                ['LIST-EXTENDED', true]
+            ],
+            status: 'NO'
+        },
+        { capabilities: [['IMAP4rev1', true]], status: 'BAD' }
+    ]) {
+        let listCalls = 0;
+        let lsubCalls = 0;
+        const connection = createMockConnection({
+            state: 3,
+            capabilities: new Map(capabilities),
+            exec: async (cmd, attrs) => {
+                if (cmd === 'LSUB') {
+                    lsubCalls++;
+                }
+                if (cmd === 'LIST') {
+                    listCalls++;
+                    if (attrs[1] === 'INBOX') {
+                        throw commandError('Command failed', status);
+                    }
+                }
+                return { next: () => {} };
+            }
+        });
+
+        try {
+            await listCommand(connection, 'Mail/', '*');
+            test.ok(false, 'Should have thrown');
+        } catch (err) {
+            test.equal(err.responseStatus, status);
+        }
+        // Main listing and the failed INBOX call - no plain retry, no LSUB merge
+        test.equal(listCalls, 2);
+        test.equal(lsubCalls, 0);
+    }
+    test.done();
+};
+
 module.exports['Commands: list handles LSUB merging'] = async test => {
     const connection = createMockConnection({
         state: 3,
@@ -4851,18 +4931,28 @@ module.exports['Commands: list discards partial results from a rejected INBOX fi
         state: 3,
         capabilities: new Map([
             ['IMAP4rev1', true],
-            ['LIST-EXTENDED', true]
+            ['LIST-EXTENDED', true],
+            ['SPECIAL-USE', true]
         ]),
         exec: async (cmd, attrs, opts) => {
             if (cmd === 'LIST') {
                 listAttempts.push(JSON.stringify(attrs));
                 if (listAttempts.length === 1) {
                     await opts.untagged.LIST({
-                        attributes: [[{ value: '\\Subscribed' }, { value: '\\HasNoChildren' }], { value: '.' }, { value: 'Prefix.Folder1' }]
+                        attributes: [
+                            [{ value: '\\Subscribed' }, { value: '\\HasNoChildren' }, { value: '\\Sent' }],
+                            { value: '.' },
+                            { value: 'Prefix.Folder1' }
+                        ]
                     });
                 } else if (listAttempts.length === 2) {
-                    // The fixup attempt streams an untagged INBOX line and THEN gets
-                    // the tagged BAD - the partial line must not survive the retry
+                    // The fixup attempt streams untagged lines and THEN gets the tagged
+                    // BAD - the partial lines must not survive the retry. "Aliased" also
+                    // claims \Sent and sorts ahead of the main run's Prefix.Folder1, so
+                    // it would steal the special-use slot if it were not rolled back
+                    await opts.untagged.LIST({
+                        attributes: [[{ value: '\\Sent' }], { value: '.' }, { value: 'Aliased' }]
+                    });
                     await opts.untagged.LIST({
                         attributes: [[{ value: '\\HasNoChildren' }], { value: '.' }, { value: 'INBOX' }]
                     });
@@ -4881,7 +4971,9 @@ module.exports['Commands: list discards partial results from a rejected INBOX fi
     test.equal(listAttempts.length, 3);
     // Exactly one INBOX entry - the rejected attempt's partial line was discarded
     test.equal(result.filter(e => e.path === 'INBOX').length, 1);
-    test.ok(result.find(e => e.path === 'Prefix.Folder1'));
+    test.ok(!result.some(e => e.path === 'Aliased'), 'the rejected attempt entry is gone');
+    // The main run's special-use match survived the rollback of the rejected attempt
+    test.equal(result.find(e => e.path === 'Prefix.Folder1').specialUse, '\\Sent');
     test.done();
 };
 

package/test/idle-polling-test.js

@@ -347,3 +347,84 @@ module.exports['Polling: no polling session without a saved select command'] = a
     test.equal(connection.idling, false, 'idling untouched');
     test.done();
 };
+
+module.exports['Polling: a falsy STATUS result stops the loop as PollFailed'] = async test => {
+    await withFakeTimers(async timers => {
+        let warnings = [];
+        let connection = createConnection({
+            missingIdleCommand: 'STATUS',
+            // Only STATUS is ever polled; a failure without a NO status makes the
+            // real STATUS implementation swallow the error and return false
+            respond: async () => {
+                throw new Error('Command failed');
+            }
+        });
+        connection.log.warn = entry => warnings.push(entry);
+
+        let idlePromise = idleCommand(connection, 60000);
+        await timers.drain();
+        await idlePromise;
+
+        test.ok(
+            warnings.some(entry => entry && entry.err && entry.err.code === 'PollFailed'),
+            'the falsy STATUS result surfaced as a PollFailed error'
+        );
+        test.equal(connection.idling, false, 'idling reset after the failed poll');
+        test.equal(connection.preCheck, false, 'preCheck released');
+        test.equal(timers.count(), 0, 'polling stopped');
+        test.done();
+    });
+};
+
+module.exports['Polling: a repeated break call is a no-op'] = async test => {
+    await withFakeTimers(async timers => {
+        let connection = createConnection();
+
+        let idlePromise = idleCommand(connection, 60000);
+        await timers.drain();
+        test.deepEqual(connection.commands, ['NOOP'], 'the immediate first poll ran');
+
+        // A caller may hold on to the break function and invoke it more than once
+        let preCheck = connection.preCheck;
+        await preCheck();
+        await preCheck();
+        await idlePromise;
+
+        test.equal(connection.idling, false, 'idling reset');
+        test.equal(connection.preCheck, false, 'preCheck released');
+        test.equal(timers.count(), 0, 'no timer left armed');
+
+        await timers.fire();
+        test.deepEqual(connection.commands, ['NOOP'], 'no further poll after the duplicate break');
+        test.done();
+    });
+};
+
+module.exports['Polling: a break in the initiation tick prevents the first poll'] = async test => {
+    await withFakeTimers(async timers => {
+        let connection = createConnection();
+        // Simulate a break request (e.g. a command being queued) landing in the same
+        // tick the loop is initiated: trap the loop installing its own preCheck and
+        // break through it immediately, before the first poll has started
+        let installedPreCheck = connection.preCheck;
+        Object.defineProperty(connection, 'preCheck', {
+            get: () => installedPreCheck,
+            set: value => {
+                installedPreCheck = value;
+                if (typeof value === 'function') {
+                    value();
+                }
+            }
+        });
+
+        let idlePromise = idleCommand(connection, 60000);
+        await timers.drain();
+        await idlePromise;
+
+        test.deepEqual(connection.commands, [], 'the already-cancelled session never polled');
+        test.equal(connection.idling, false, 'idling reset');
+        test.equal(connection.preCheck, false, 'preCheck released');
+        test.equal(timers.count(), 0, 'no timer left armed');
+        test.done();
+    });
+};

package/test/imap-compiler-test.js

@@ -642,10 +642,11 @@ module.exports['IMAP Compiler: partial range in SECTION'] = test =>
 
 // Returns the error a compile attempt raised, or undefined when it succeeded.
 // Several cases below assert that a token can never reach the wire, and the
-// try/catch is the only interesting part of each.
-const compileError = async attributes => {
+// try/catch is the only interesting part of each. Takes either an attributes
+// array (compiled under a default tag/command) or a full response object.
+const compileError = async input => {
     try {
-        await compiler({ tag: 'A', command: 'CMD', attributes });
+        await compiler(Array.isArray(input) ? { tag: 'A', command: 'CMD', attributes: input } : input);
     } catch (err) {
         return err;
     }
@@ -663,10 +664,50 @@ module.exports['IMAP Compiler: SEQUENCE rejects values that are not sequence set
 
 module.exports['IMAP Compiler: SEQUENCE accepts every valid sequence-set form'] = test =>
     asyncWrapper(test, async test => {
-        for (let value of ['1', '*', '1:*', '*:1', '1,3,5', '1:3,7,9:*', '4294967295']) {
+        // '$' is the RFC 5182 SEARCHRES saved-result marker, valid as the entire set
+        for (let value of ['1', '*', '1:*', '*:1', '1,3,5', '1:3,7,9:*', '4294967295', '$']) {
             const compiled = (await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'SEQUENCE', value }] })).toString();
             test.equal(compiled, `A FETCH ${value}`);
         }
+
+        // '$' only stands for the whole set, never an element of one
+        for (let value of ['$,1', '1,$', '$:2']) {
+            let err = await compileError([{ type: 'SEQUENCE', value }]);
+            test.equal(err && err.code, 'InvalidSequenceSet', `${JSON.stringify(value)} must be rejected`);
+        }
+    });
+
+module.exports['IMAP Compiler: SEQUENCE validation stays linear on huge valid sets'] = test =>
+    asyncWrapper(test, async test => {
+        // The regex this replaced overflowed the engine's backtrack stack with an
+        // uncoded RangeError at roughly a million comma-separated elements - a set
+        // a fetch over a large mailbox can legitimately produce
+        const huge = Array.from({ length: 1500000 }, (_, i) => i + 1).join(',');
+        const compiled = await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'SEQUENCE', value: huge }] });
+        test.ok(compiled.toString().endsWith(huge), 'the huge but valid set must compile');
+    });
+
+module.exports['IMAP Compiler: SEQUENCE validation is skipped when logging'] = test =>
+    asyncWrapper(test, async test => {
+        // The incoming token parser accepts sequence-shaped tokens the strict grammar
+        // rejects (an ESEARCH set like "1:2:3", a folder name like "12:30:00"). Every
+        // parsed server response is re-compiled for the log, so a throw here would let
+        // one quirky server line kill the whole connection.
+        for (let value of ['1:2:3', '12:30:00', '1,2:3:4']) {
+            const compiled = (await compiler({ tag: '*', command: 'OK', attributes: [{ type: 'SEQUENCE', value }] }, { isLogging: true })).toString();
+            test.equal(compiled, `* OK ${value}`, 'logging re-compile must pass the token through');
+        }
+    });
+
+module.exports['IMAP Compiler: tag and command cannot carry a line terminator'] = test =>
+    asyncWrapper(test, async test => {
+        // The tag/command preamble is written verbatim ahead of any token, so it goes
+        // through the same choke point as everything else
+        let err = await compileError({ tag: 'A\r\nZZ LOGOUT', command: 'NOOP' });
+        test.equal(err && err.code, 'InvalidTokenValue', 'CRLF in the tag must be rejected');
+
+        err = await compileError({ tag: 'A', command: 'NOOP\r\nZZ LOGOUT' });
+        test.equal(err && err.code, 'InvalidTokenValue', 'CRLF in the command must be rejected');
     });
 
 module.exports['IMAP Compiler: quoted strings use IMAP escaping, not JSON escaping'] = test =>
@@ -707,6 +748,23 @@ module.exports['IMAP Compiler: NUMBER coerces its value instead of writing it th
         test.equal((await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value: '42' }] })).toString(), 'A CMD 42');
     });
 
+module.exports['IMAP Compiler: numeric tokens clamp to bounded non-negative integers'] = test =>
+    asyncWrapper(test, async test => {
+        // Infinity, negatives and unsafe magnitudes would otherwise emit bytes outside
+        // the number alphabet ("Infinity", "-5", "1e+300") and get a server BAD blamed
+        // on the server instead of the caller
+        for (let [value, expected] of [
+            [Infinity, '0'],
+            ['Infinity', '0'],
+            [-5, '0'],
+            ['2e21', '0'],
+            [4.6, '5']
+        ]) {
+            const compiled = (await compiler({ tag: 'A', command: 'CMD', attributes: [{ type: 'NUMBER', value }] })).toString();
+            test.equal(compiled, `A CMD ${expected}`, `${JSON.stringify(value)} must clamp to ${expected}`);
+        }
+    });
+
 module.exports['IMAP Compiler: partial range coerces its elements'] = test =>
     asyncWrapper(test, async test => {
         // The partial range is the last token component written verbatim, so it is
@@ -719,6 +777,18 @@ module.exports['IMAP Compiler: partial range coerces its elements'] = test =>
             await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: [0, 1024] }] })
         ).toString();
         test.equal(normal, 'A FETCH BODY.PEEK[]<0.1024>');
+
+        // Floats and unbounded numerics clamp the same way NUMBER tokens do, so no
+        // non-digit byte ("512.5", "Infinity") can appear inside the partial range
+        const float = (
+            await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: [0, 512.5] }] })
+        ).toString();
+        test.equal(float, 'A FETCH BODY.PEEK[]<0.513>');
+
+        const unbounded = (
+            await compiler({ tag: 'A', command: 'FETCH', attributes: [{ type: 'ATOM', value: 'BODY.PEEK', section: [], partial: ['Infinity', '2e21'] }] })
+        ).toString();
+        test.equal(unbounded, 'A FETCH BODY.PEEK[]<0.0>');
     });
 
 module.exports['IMAP Compiler: logging output never throws on unsendable values'] = test =>

package/test/imap-flow-internals-test.js

@@ -471,3 +471,137 @@ module.exports['Internals: untaggedFetch includes modseq and flagColor'] = async
     test.equal(evt.flagColor, 'red');
     test.done();
 };
+
+// ============================================================================
+// runInternal dispatch guards
+// ============================================================================
+
+module.exports['Internals: runInternal returns false for unknown command'] = async test => {
+    let client = makeClient();
+    client.socket = { destroyed: false };
+    let res = await client.runInternal('NOT_A_COMMAND');
+    test.equal(res, false);
+    test.done();
+};
+
+module.exports['Internals: runInternal throws NoConnection when the socket is destroyed'] = async test => {
+    let client = makeClient();
+    client.socket = { destroyed: true };
+    let err = null;
+    try {
+        await client.runInternal('NOOP');
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err);
+    test.equal(err.code, 'NoConnection');
+    test.done();
+};
+
+// ============================================================================
+// send() onSend error containment
+// ============================================================================
+
+module.exports['Internals: send contains a throwing onSend callback'] = async test => {
+    let client = makeClient();
+    let written = [];
+    let warnings = [];
+    client.socket = { destroyed: false };
+    client.writeSocket = { destroyed: false, write: chunk => written.push(chunk) };
+    client.state = client.states.AUTHENTICATED;
+    client.log.warn = entry => warnings.push(entry);
+    client.currentRequest = { tag: 'A1', sent: false };
+
+    // The command is already on the wire when onSend runs, so a throwing callback
+    // must be logged and swallowed instead of rejecting the request
+    await client.send({
+        tag: 'A1',
+        command: 'NOOP',
+        attributes: [],
+        options: {
+            onSend: () => {
+                throw new Error('onSend boom');
+            }
+        }
+    });
+
+    test.equal(written.length, 1, 'the command was written to the socket');
+    test.equal(written[0].toString(), 'A1 NOOP\r\n', 'the actual wire bytes went out before onSend ran');
+    test.equal(client.currentRequest.sent, true, 'the request is marked as sent');
+    test.ok(
+        warnings.some(entry => entry && entry.err && entry.err.message === 'onSend boom'),
+        'the callback error was logged'
+    );
+    test.done();
+};
+
+// ============================================================================
+// countUnknownTag teardown guard
+// ============================================================================
+
+module.exports['Internals: countUnknownTag ignores tags on a closed connection'] = test => {
+    let client = makeClient();
+    client.isClosed = true;
+    client.countUnknownTag('A1');
+    test.equal(client._unknownTagCount, 0, 'teardown crossover is not counted');
+    test.done();
+};
+
+// ============================================================================
+// rejectUnparsedCompletion
+// ============================================================================
+
+// Installs a command that is current and on the wire, returning a holder for
+// the rejection the reader loop would deliver to the caller
+const armInFlight = (client, tag) => {
+    let captured = { err: null };
+    client.currentRequest = { tag, sent: true };
+    client.requestTagMap.set(tag, {
+        tag,
+        reject: err => {
+            captured.err = err;
+        }
+    });
+    return captured;
+};
+
+module.exports['Internals: rejectUnparsedCompletion ignores lines without an in-flight command'] = test => {
+    let client = makeClient();
+
+    client.currentRequest = false;
+    client.rejectUnparsedCompletion(Buffer.from('A1 OK done'), new Error('parse fail'));
+    test.equal(client.currentRequest, false, 'no request to settle');
+
+    // A command that is current but not yet on the wire must not be settled either
+    client.currentRequest = { tag: 'A1', sent: false };
+    client.rejectUnparsedCompletion(Buffer.from('A1 OK done'), new Error('parse fail'));
+    test.ok(client.currentRequest, 'the unsent request is untouched');
+    test.done();
+};
+
+module.exports['Internals: rejectUnparsedCompletion recovers the tag from NUL-padded raw bytes'] = async test => {
+    let client = makeClient();
+    let captured = armInFlight(client, 'A1');
+
+    // The parser died before extracting a tag - the raw line carries the buggy-server
+    // NUL padding, so the fallback must skip it and stop at the first non-tag byte
+    let parserError = new Error('parse fail');
+    client.rejectUnparsedCompletion(Buffer.from('\x00\x00A1 \x07garbage'), parserError);
+
+    test.ok(captured.err, 'the in-flight command was failed');
+    test.equal(captured.err.code, 'ParserError');
+    test.equal(captured.err.parserError, parserError);
+    test.equal(client.currentRequest, false, 'the request slot was cleared');
+    test.done();
+};
+
+module.exports['Internals: rejectUnparsedCompletion ignores a mismatched raw tag'] = test => {
+    let client = makeClient();
+    let captured = armInFlight(client, 'A1');
+
+    client.rejectUnparsedCompletion(Buffer.from('A2 NO other'), new Error('parse fail'));
+
+    test.equal(captured.err, null, 'a line for another tag settles nothing');
+    test.ok(client.currentRequest, 'the in-flight request stays current');
+    test.done();
+};