imapflow 1.6.4 → 1.6.5

package/test/imap-flow-secure-test.js

@@ -75,37 +75,48 @@ const lineReader = (sock, onLine) => {
 
 const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', () => resolve(server.address().port)));
 
-// ---------------------------------------------------------------------------
-// STARTTLS happy path
-// ---------------------------------------------------------------------------
-
-module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
-    let server = net.createServer(rawSocket => {
+// Builds a STARTTLS mock server. Defaults give the happy path; options tweak a
+// phase without another copy of the upgrade scaffold:
+// - preTlsCaps / postTlsCaps: capability list advertised before / after the upgrade
+// - startTlsOk: tag => string, overrides the response line to the STARTTLS command
+// - onTlsLine: (tlsSocket, line) => boolean, intercepts post-upgrade lines; return
+//   true when the line was handled
+const createStartTlsServer = (opts = {}) =>
+    net.createServer(rawSocket => {
         rawSocket.on('error', () => {});
 
+        let preTlsCaps = opts.preTlsCaps || `${CAPS} STARTTLS`;
+        let postTlsCaps = opts.postTlsCaps || CAPS;
+
         let detachPlain;
         detachPlain = lineReader(rawSocket, line => {
-            handleLine(
-                rawSocket,
-                line,
-                () => {
-                    // Upgrade: stop reading plaintext, wrap the socket in TLS
-                    detachPlain();
-                    let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                    tlsSocket.on('error', () => {});
-                    tlsSocket.on('secure', () => {});
-                    // post-TLS phase advertises a different capability set
-                    lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, `${CAPS} POSTTLS-ONLY`));
-                },
-                `${CAPS} STARTTLS PRETLS-ONLY`
-            );
+            let parts = line.split(' ');
+            let tag = parts[0];
+            let cmd = (parts[1] || '').toUpperCase();
+
+            if (cmd === 'STARTTLS') {
+                rawSocket.write(opts.startTlsOk ? opts.startTlsOk(tag) : `${tag} OK Begin TLS\r\n`);
+                detachPlain();
+                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
+                tlsSocket.on('error', () => {});
+                lineReader(tlsSocket, l => {
+                    if (opts.onTlsLine && opts.onTlsLine(tlsSocket, l)) {
+                        return;
+                    }
+                    handleLine(tlsSocket, l, null, postTlsCaps);
+                });
+                return;
+            }
+
+            handleLine(rawSocket, line, null, preTlsCaps);
         });
 
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS PRETLS-ONLY] ready\r\n`);
+        rawSocket.write(`* OK [CAPABILITY ${preTlsCaps}] ready\r\n`);
     });
 
-    let port = await listen(server);
-    let client = new ImapFlow({
+// The client options shared by every STARTTLS test.
+const makeStartTlsClient = (port, overrides = {}) =>
+    new ImapFlow({
         host: '127.0.0.1',
         port,
         secure: false,
@@ -115,8 +126,30 @@ module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
         disableAutoIdle: true,
         disableCompression: true,
         logger: false,
-        auth: { user: 'test', pass: 'secret' }
+        auth: { user: 'test', pass: 'secret' },
+        ...overrides
     });
+
+// Every terminal upgrade path must leave no upgrade state behind
+const assertUpgradeSettled = (test, client) => {
+    test.equal(client.upgrading, false, 'upgrading flag cleared');
+    test.equal(client._upgradeReject, null, 'upgrade rejector cleared');
+    test.equal(client.upgradeTimeout, null, 'upgrade timer cleared');
+};
+
+// ---------------------------------------------------------------------------
+// STARTTLS happy path
+// ---------------------------------------------------------------------------
+
+module.exports['Secure: STARTTLS upgrade completes a session'] = async test => {
+    // post-TLS phase advertises a different capability set
+    let server = createStartTlsServer({
+        preTlsCaps: `${CAPS} STARTTLS PRETLS-ONLY`,
+        postTlsCaps: `${CAPS} POSTTLS-ONLY`
+    });
+
+    let port = await listen(server);
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     await client.connect();
@@ -141,43 +174,15 @@ module.exports['Secure: STARTTLS discards capabilities even when the OK carries
     // a discard conditioned on "an update is still pending" would keep exactly the
     // pre-TLS list an attacker controls - the list that then chooses the AUTH
     // mechanism and answers LOGINDISABLED. RFC 9051 6.2.1 makes the discard mandatory.
-    let server = net.createServer(rawSocket => {
-        rawSocket.on('error', () => {});
-
-        let detachPlain;
-        detachPlain = lineReader(rawSocket, line => {
-            let parts = line.split(' ');
-            let tag = parts[0];
-            let cmd = (parts[1] || '').toUpperCase();
-
-            if (cmd === 'STARTTLS') {
-                rawSocket.write(`${tag} OK [CAPABILITY ${CAPS} PRETLS-ONLY] Begin TLS\r\n`);
-                detachPlain();
-                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                tlsSocket.on('error', () => {});
-                lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, `${CAPS} POSTTLS-ONLY`));
-                return;
-            }
-
-            handleLine(rawSocket, line, null, `${CAPS} STARTTLS PRETLS-ONLY`);
-        });
-
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS PRETLS-ONLY] ready\r\n`);
+    let server = createStartTlsServer({
+        preTlsCaps: `${CAPS} STARTTLS PRETLS-ONLY`,
+        postTlsCaps: `${CAPS} POSTTLS-ONLY`,
+        // the OK itself carries a (pre-TLS, attacker-rewritable) CAPABILITY code
+        startTlsOk: tag => `${tag} OK [CAPABILITY ${CAPS} PRETLS-ONLY] Begin TLS\r\n`
     });
 
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     await client.connect();
@@ -191,23 +196,40 @@ module.exports['Secure: STARTTLS discards capabilities even when the OK carries
     test.done();
 };
 
-// Builds the STARTTLS happy-path server used by the watchdog and cleanup tests below.
-const createStartTlsServer = () =>
-    net.createServer(rawSocket => {
-        rawSocket.on('error', () => {});
+module.exports['Secure: pre-TLS rawCapabilities do not survive a failed re-fetch'] = async test => {
+    // capabilities/authCapabilities are discarded at the upgrade, but rawCapabilities
+    // is public surface external consumers read. If the post-TLS CAPABILITY re-fetch
+    // fails, the pre-TLS list - the one an active attacker can rewrite - must not
+    // linger there either.
+    let server = createStartTlsServer({
+        preTlsCaps: `${CAPS} STARTTLS PRETLS-ONLY`,
+        postTlsCaps: `${CAPS} POSTTLS-ONLY`,
+        onTlsLine: (tlsSocket, line) => {
+            let parts = line.split(' ');
+            if ((parts[1] || '').toUpperCase() === 'CAPABILITY') {
+                // the re-fetch over TLS fails
+                tlsSocket.write(`${parts[0]} NO CAPABILITY not available\r\n`);
+                return true;
+            }
+            return false;
+        }
+    });
 
-        let detachPlain;
-        detachPlain = lineReader(rawSocket, line => {
-            handleLine(rawSocket, line, () => {
-                detachPlain();
-                let tlsSocket = new tls.TLSSocket(rawSocket, { isServer: true, key, cert });
-                tlsSocket.on('error', () => {});
-                lineReader(tlsSocket, l => handleLine(tlsSocket, l, null, CAPS));
-            });
-        });
+    let port = await listen(server);
+    let client = makeStartTlsClient(port);
+    client.on('error', () => {});
 
-        rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
-    });
+    await client.connect();
+    test.ok(client.secureConnection, 'connection upgraded to TLS');
+    test.ok(!client.capabilities.has('PRETLS-ONLY'), 'pre-TLS capabilities were discarded');
+    let raw = [].concat(client.rawCapabilities || []);
+    test.ok(!raw.some(entry => entry && /PRETLS-ONLY/.test(entry.value || entry)), 'pre-TLS rawCapabilities were discarded');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
 
 // Records every socket that went through configureSocket(), which is the single place the
 // transport options (keepalive + inactivity watchdog) are applied.
@@ -227,19 +249,7 @@ module.exports['Secure: STARTTLS session keeps the inactivity watchdog'] = async
     // and a dead connection was never noticed.
     let server = createStartTlsServer();
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        socketTimeout: 200,
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port, { socketTimeout: 200 });
 
     let errors = [];
     client.on('error', err => errors.push(err));
@@ -271,25 +281,12 @@ module.exports['Secure: STARTTLS leaves no upgrade state behind on success'] = a
     // a successful handshake no timer, rejector, flag or temporary handler survives.
     let server = createStartTlsServer();
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     await client.connect();
 
-    test.equal(client.upgrading, false, 'upgrading flag cleared');
-    test.equal(client._upgradeReject, null, 'upgrade rejector cleared');
-    test.equal(client.upgradeTimeout, null, 'upgrade timer cleared');
+    assertUpgradeSettled(test, client);
     // The handshake-only handler is gone, leaving the generic socket error handler as the single
     // error path (during the handshake it is the other way round, which is what prevents a
     // handshake error from firing two handlers at once).
@@ -314,18 +311,7 @@ module.exports['Secure: close() during a STARTTLS upgrade settles the upgrade']
         rawSocket.write(`* OK [CAPABILITY ${CAPS} STARTTLS] ready\r\n`);
     });
     let port = await listen(server);
-    let client = new ImapFlow({
-        host: '127.0.0.1',
-        port,
-        secure: false,
-        doSTARTTLS: true,
-        servername: 'localhost',
-        tls: { rejectUnauthorized: false },
-        disableAutoIdle: true,
-        disableCompression: true,
-        logger: false,
-        auth: { user: 'test', pass: 'secret' }
-    });
+    let client = makeStartTlsClient(port);
     client.on('error', () => {});
 
     let connectResult = client.connect().then(
@@ -337,15 +323,46 @@ module.exports['Secure: close() during a STARTTLS upgrade settles the upgrade']
     while (!client.upgrading) {
         await new Promise(resolve => setTimeout(resolve, 10));
     }
+    // A late socket event would invoke the same settle helper the rejector exposes -
+    // capture it before close() consumes it
+    let settle = client._upgradeReject;
     client.close();
 
     let err = await connectResult;
     test.ok(err, 'connect rejected rather than hanging on the abandoned upgrade');
     test.ok(['ClosedAfterConnectText', 'ClosedAfterConnectTLS', 'NoConnection'].includes(err.code), `connect rejected with ${err.code}`);
-    test.equal(client.upgrading, false, 'upgrading flag cleared');
-    test.equal(client._upgradeReject, null, 'upgrade rejector cleared');
-    test.equal(client.upgradeTimeout, null, 'upgrade timer cleared');
+    assertUpgradeSettled(test, client);
+
+    // The late event lands after the upgrade already settled - it must be a no-op:
+    // a settled upgrade neither claims the error as a TLS failure nor re-arms any state
+    let lateErr = new Error('late socket error');
+    settle(lateErr);
+    test.ok(!lateErr.tlsFailed, 'the late error was not marked as a TLS upgrade failure');
+    assertUpgradeSettled(test, client);
+
+    server.close();
+    test.done();
+};
 
+module.exports['Secure: STARTTLS handshake failure rejects connect'] = async test => {
+    let server = createStartTlsServer();
+    let port = await listen(server);
+    // The tls option is erased entirely, not merely relaxed: certificate validation
+    // stays on, so the mock server's self-signed certificate must fail the handshake,
+    // and the upgrade builds its TLS options from the no-options fallback
+    let client = makeStartTlsClient(port, { tls: undefined });
+    client.on('error', () => {});
+
+    let err = await client.connect().then(
+        () => null,
+        connectErr => connectErr
+    );
+
+    test.ok(err, 'connect rejected on the failed handshake');
+    test.ok(err.tlsFailed, 'the error is marked as a TLS upgrade failure');
+    assertUpgradeSettled(test, client);
+
+    client.close();
     server.close();
     test.done();
 };

package/test/imap-flow-server-test.js

@@ -1346,3 +1346,129 @@ module.exports['Server: an unparseable tagged completion fails the command inste
     server.close();
     test.done();
 };
+
+module.exports['Server: a NUL-padded unparseable completion still fails the command'] = async test => {
+    // Buggy servers pad lines with leading NUL bytes; the parser strips them before
+    // reading the tag. The unparsed-completion recovery has to see the same tag the
+    // parser saw, or the command hangs for exactly the server class the NUL
+    // workaround exists for.
+    let server = createServer({
+        handlers: {
+            SELECT(ctx) {
+                ctx.write(`\x00\x00${ctx.tag} OK [\x01BAD-CODE] SELECT completed\r\n`);
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+
+    let selectErr = null;
+    try {
+        await client.mailboxOpen('INBOX');
+    } catch (err) {
+        selectErr = err;
+    }
+    test.ok(selectErr, 'the command whose completion could not be parsed must reject');
+
+    let folders = await client.list();
+    test.ok(Array.isArray(folders) && folders.length, 'later commands still run');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Server: a sequence-shaped token in a server response does not fail the connection'] = async test => {
+    // The incoming token parser accepts sequence-shaped tokens the strict outgoing
+    // grammar rejects ("1:2:3"). Every parsed response is re-compiled for the log, so
+    // that pass must skip the validation - one quirky but parseable server line would
+    // otherwise tear down the whole connection.
+    let server = createServer({
+        handlers: {
+            NOOP(ctx) {
+                ctx.write(`${ctx.tag} OK [XDATA 1:2:3] NOOP completed\r\n`);
+            }
+        }
+    });
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+    await client.noop();
+    test.ok(client.usable, 'connection must stay usable');
+
+    let folders = await client.list();
+    test.ok(Array.isArray(folders) && folders.length, 'later commands still run');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Server: an invalid range rejects the command without wedging the queue'] = async test => {
+    // The compiler refuses invalid sequence sets before anything reaches the wire.
+    // The dispatch layer has to treat that as the command's own failure: the request
+    // must reject (even when queued behind an in-flight command) and the queue must
+    // keep moving instead of waiting forever on a response that can never arrive.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+    await client.mailboxOpen('INBOX');
+
+    let err = null;
+    try {
+        await client.fetchOne('1;2', { uid: true });
+    } catch (e) {
+        err = e;
+    }
+    test.ok(err, 'the invalid range must reject');
+    test.equal(err && err.code, 'InvalidSequenceSet');
+
+    // Queued variant: the invalid command sits behind an in-flight one; every promise
+    // must settle and the command behind the invalid one must still run
+    let results = await Promise.allSettled([client.noop(), client.fetchOne('3;4', { uid: true }), client.noop()]);
+    test.equal(results[0].status, 'fulfilled', 'command before the invalid one succeeds');
+    test.equal(results[1].status, 'rejected', 'queued invalid command must reject, not hang');
+    test.equal(results[2].status, 'fulfilled', 'command after the invalid one still runs');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};
+
+module.exports['Server: a throwing response listener does not fail the command'] = async test => {
+    // 'response' is emitted after a tagged completion parses successfully. A listener
+    // throwing synchronously used to be caught by the parse-failure path, which
+    // rejected the in-flight command with a bogus ParserError even though the server
+    // had executed it.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+    client.on('response', payload => {
+        if (payload.response === 'OK') {
+            throw new Error('listener bug');
+        }
+    });
+
+    await client.noop();
+    let mailbox = await client.mailboxOpen('INBOX');
+    test.ok(mailbox, 'commands succeed despite the throwing listener');
+
+    await client.logout();
+    client.close();
+    server.close();
+    test.done();
+};

package/test/imap-parser-test.js

@@ -1447,3 +1447,28 @@ module.exports['IMAP Parser: balanced brackets inside a response code are still
         test.equal(text, 'Flags permitted.');
         test.equal(parsed.attributes[0].section[0].value, 'PERMANENTFLAGS');
     });
+
+module.exports['IMAP Parser: a parse failure after the tag exposes the parsed tag'] = test =>
+    asyncWrapper(test, async test => {
+        // The connection settles the in-flight command from an unparseable tagged
+        // completion using this tag - re-deriving it from the raw bytes instead would
+        // bypass the leading-NUL workaround and strand the command
+        let err = null;
+        try {
+            await parser(Buffer.from('A5 OK [\x01BAD-CODE] done', 'binary'));
+        } catch (e) {
+            err = e;
+        }
+        test.ok(err, 'the line must fail to parse');
+        test.equal(err && err.parsedTag, 'A5');
+
+        // The NUL-padding workaround is inherited: the exposed tag is the stripped one
+        err = null;
+        try {
+            await parser(Buffer.from('\x00\x00A6 OK [\x01BAD-CODE] done', 'binary'));
+        } catch (e) {
+            err = e;
+        }
+        test.ok(err, 'the padded line must fail to parse');
+        test.equal(err && err.parsedTag, 'A6');
+    });

package/test/imap-stream-edge-cases-test.js

@@ -475,15 +475,39 @@ module.exports['Literal marker scan stays linear on a long digit run'] = test =>
     test.done();
 };
 
-module.exports['Literal marker rejects an oversized digit run without parsing it'] = test => {
+module.exports['Literal marker fails the stream on an oversized digit run'] = test => {
+    // An impossible size is still a syntactically valid marker. Treating it as an
+    // ordinary line instead would feed the announced literal body to the line parser
+    // and desynchronize the session, so the stream must end with LiteralTooLarge.
     const stream = new ImapStream({ cid: 'test' });
-    stream.on('error', () => {});
+    let streamErr = null;
+    stream.on('error', err => {
+        streamErr = err;
+    });
     stream.resume();
 
-    // Longer than any number64 can be, so it cannot be a valid marker
     const line = Buffer.concat([Buffer.from('* OK {'), Buffer.from('1'.repeat(40)), Buffer.from('}\r\n')]);
 
     test.equal(stream.checkLiteralMarker(line), false, 'an impossible size must not start literal mode');
+    test.ok(stream.destroyed, 'the stream must fail closed instead of continuing as if the marker were text');
+    setImmediate(() => {
+        test.ok(streamErr && streamErr.code === 'LiteralTooLarge', 'must fail with LiteralTooLarge');
+        test.done();
+    });
+};
+
+module.exports['Literal marker accepts a zero-padded size'] = test => {
+    // The RFC "number" production is 1*DIGIT, so leading zeros are legal - a long
+    // digit run can still denote a small size and must be consumed as a literal
+    const stream = new ImapStream({ cid: 'test' });
+    stream.on('error', () => {});
+    stream.resume();
+
+    const line = Buffer.from(`* 1 FETCH (BODY[] {${'0'.repeat(21)}123}\r\n`);
+
+    test.equal(stream.checkLiteralMarker(line), true, 'a zero-padded marker is a valid literal marker');
+    test.equal(stream.literalWaiting, 123, 'the padded size must parse to its numeric value');
+    stream.destroy();
     test.done();
 };
 

package/test/integration/rev2-live-test.js

@@ -212,6 +212,36 @@ module.exports['Live rev2: returnOptions search is answered via a real ESEARCH r
     test.done();
 };
 
+module.exports['Live rev2: SEARCHRES saved result is usable as a sequence set'] = async test => {
+    // SEARCH RETURN (SAVE) stores the result server-side (RFC 5182) and '$'
+    // references it in later commands. '$' has to make it through the outgoing
+    // sequence-set validation for that to work at all.
+    const client = await connectClient();
+    try {
+        test.ok(client.capabilities.has('SEARCHRES'), 'Dovecot should advertise SEARCHRES');
+
+        await client.append('INBOX', Buffer.from('Subject: first\r\n\r\nfirst\r\n'));
+        await client.append('INBOX', Buffer.from('Subject: second\r\n\r\nsecond\r\n'));
+
+        await client.mailboxOpen('INBOX');
+        await client.search({ subject: 'second' }, { uid: true, returnOptions: ['SAVE'] });
+
+        let flagResult = await client.messageFlagsAdd('$', ['\\Flagged'], { uid: true });
+        test.ok(flagResult, 'STORE against the saved result must succeed');
+
+        let messages = [];
+        for await (let msg of client.fetch('$', { flags: true, envelope: true }, { uid: true })) {
+            messages.push(msg);
+        }
+        test.equal(messages.length, 1, 'the saved result references exactly the matched message');
+        test.equal(messages[0].envelope.subject, 'second');
+        test.ok(messages[0].flags.has('\\Flagged'), 'the flag change applied to the saved result');
+    } finally {
+        await client.logout();
+    }
+    test.done();
+};
+
 module.exports['Live rev2: MODSEQ search criterion surfaces modseq from the ESEARCH response'] = async test => {
     const client = await connectClient();
     try {