imapflow 1.6.4 → 1.6.6

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.6.4"
+    ".": "1.6.6"
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.6.6](https://github.com/postalsys/imapflow/compare/v1.6.5...v1.6.6) (2026-08-07)
+
+
+### Bug Fixes
+
+* harden parsing of untrusted server response values ([1560424](https://github.com/postalsys/imapflow/commit/15604240b5fe5f7ec57514db17f41123140b53fe))
+
+## [1.6.5](https://github.com/postalsys/imapflow/compare/v1.6.4...v1.6.5) (2026-07-29)
+
+
+### Bug Fixes
+
+* resolve regressions from the rev2 hardening commit and harden further ([0739df9](https://github.com/postalsys/imapflow/commit/0739df93709d2c7d572e977c2b37b6d219e69e30))
+
 ## [1.6.4](https://github.com/postalsys/imapflow/compare/v1.6.3...v1.6.4) (2026-07-29)
 
 

package/lib/commands/append.js

@@ -1,6 +1,17 @@
 'use strict';
 
-const { formatFlag, canUseFlag, formatDateTime, normalizePath, encodePath, comparePaths, enhanceCommandError } = require('../tools.js');
+const {
+    formatFlag,
+    canUseFlag,
+    formatDateTime,
+    normalizePath,
+    encodePath,
+    comparePaths,
+    enhanceCommandError,
+    parseBigIntValue,
+    parseUintValue,
+    MAX_UINT32_DIGITS
+} = require('../tools.js');
 
 /**
  * Appends a message to a mailbox.
@@ -79,7 +90,15 @@ module.exports = async (connection, destination, content, flags, idate) => {
     // Handler for untagged EXISTS: captures the new message count which gives
     // us the sequence number of the appended message (it's the latest message).
     const handleExistsUpdate = untagged => {
-        map.seq = Number(untagged.command);
+        // The count is written into the live mailbox state below, so it has to clear the
+        // same bar untaggedExists() applies: a digit run long enough to coerce to Infinity
+        // would make resolveRange('*') compile to the literal string "Infinity" and break
+        // every range-based command until the next SELECT.
+        let seq = parseUintValue(untagged.command, MAX_UINT32_DIGITS);
+        if (seq === false) {
+            return;
+        }
+        map.seq = seq;
 
         // Update the connection's mailbox state and emit 'exists' event if the
         // count changed (notifies listeners about the new message).
@@ -109,8 +128,11 @@ module.exports = async (connection, destination, content, flags, idate) => {
         if (section && section.length) {
             let responseCode = section[0] && typeof section[0].value === 'string' ? section[0].value : '';
             if (responseCode.toUpperCase() === 'APPENDUID') {
-                let uidValidity = section[1] && typeof section[1].value === 'string' && !isNaN(section[1].value) ? BigInt(section[1].value) : false;
-                let uid = section[2] && typeof section[2].value === 'string' && !isNaN(section[2].value) ? Number(section[2].value) : false;
+                // Bounded digit runs only: isNaN() also passes '1e5', which BigInt() rejects
+                // with a throw - and this catch rethrows, so the append would reject after the
+                // message was already stored and a retrying caller would duplicate it.
+                let uidValidity = parseBigIntValue(section[1] && section[1].value, MAX_UINT32_DIGITS);
+                let uid = parseUintValue(section[2] && section[2].value, MAX_UINT32_DIGITS);
                 if (uidValidity !== false) {
                     map.uidValidity = uidValidity;
                 }

package/lib/commands/compress.js

@@ -19,26 +19,37 @@ module.exports = async connection => {
     let response;
     try {
         response = await connection.exec('COMPRESS', [{ type: 'ATOM', value: 'DEFLATE' }]);
-        // Everything after the tagged OK is already deflate-framed (RFC 4978 section 4).
-        // The socket stays piped into the plaintext parser until this call returns, so
-        // bytes that arrived in the same chunk as the OK have been consumed as cleartext
-        // and are missing from the head of the deflate stream - the inflater would then
-        // fail and take the connection with it. Rare (it needs the server to write again
-        // before we re-pipe), and staying uncompressed is a cheaper outcome than a dead
-        // connection, so decline the upgrade instead.
-        // This only covers the bytes the parser had already buffered when the OK was
-        // handled. Closing the remaining window, and keeping compression rather than
-        // dropping it, needs the stream to hand back its unconsumed tail on unpipe so
-        // the transport can feed it into the inflater - not something a command module
-        // can reach from here.
-        response.next();
-        if (response.hasTrailingData) {
-            connection.log.warn({ msg: 'Server sent data immediately after the COMPRESS response, skipping compression', cid: connection.id });
-            return false;
-        }
-        return true;
     } catch (err) {
+        // The server declined (NO/BAD): nothing switched, staying uncompressed is safe.
         connection.log.warn({ err, cid: connection.id });
         return false;
     }
+
+    // Everything after the tagged OK is already deflate-framed (RFC 4978 section 4) -
+    // the server switches at the OK, so declining the upgrade at this point is not a
+    // protocol option. The socket stays piped into the plaintext parser until the
+    // transport swaps in the inflater, so bytes that arrived in the same chunk as the
+    // OK have been consumed as cleartext and are missing from the head of the deflate
+    // stream: the session is unrecoverable in both directions. Fail it immediately
+    // (the same way STARTTLS treats post-OK trailing data) instead of letting it die
+    // slowly on garbage. Closing this window without failing needs the stream to hand
+    // back its unconsumed tail on unpipe so the transport can feed it into the
+    // inflater - not something a command module can reach from here.
+    if (response.hasTrailingData) {
+        let error = new Error('Server sent data between the COMPRESS response and the compression layer switch');
+        error.code = 'COMPRESS_TRAILING_DATA';
+        connection.log.error({ err: error, cid: connection.id });
+        // Schedule the close before releasing parser backpressure, so the buffered
+        // deflate-framed bytes cannot settle anything before teardown begins. This is
+        // why the decision lives here rather than at the connection layer the way the
+        // STARTTLS guard does (starttls.js records a flag, upgradeToSTARTTLS decides):
+        // only the command module holds the response before its backpressure release,
+        // so only it can order teardown ahead of that release.
+        connection.closeAfter();
+        response.next();
+        throw error;
+    }
+
+    response.next();
+    return true;
 };

package/lib/commands/copyuid-parser.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { expandRange } = require('../tools.js');
+const { expandRange, parseBigIntValue } = require('../tools.js');
 
 /**
  * Parses COPYUID response code from an IMAP response (RFC 4315).
@@ -18,7 +18,9 @@ function parseCopyUid(response, map) {
         return;
     }
 
-    let uidValidity = section[1] && typeof section[1].value === 'string' && !isNaN(section[1].value) ? BigInt(section[1].value) : false;
+    // Only a bounded pure digit string is accepted: isNaN() also passes values like "1e5" or
+    // "Infinity", which BigInt() then rejects with a throw that loses the uidMap.
+    let uidValidity = parseBigIntValue(section[1] && section[1].value);
     if (uidValidity !== false) {
         map.uidValidity = uidValidity;
     }

package/lib/commands/expunge.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { enhanceCommandError, hasCapability } = require('../tools.js');
+const { enhanceCommandError, hasCapability, parseBigIntValue } = require('../tools.js');
 
 /**
  * Deletes specified messages by flagging them as Deleted and expunging.
@@ -41,7 +41,10 @@ module.exports = async (connection, range, options) => {
         let section = response.response.attributes && response.response.attributes[0] && response.response.attributes[0].section;
         let responseCode = section && section.length && section[0] && typeof section[0].value === 'string' ? section[0].value : '';
         if (responseCode.toUpperCase() === 'HIGHESTMODSEQ') {
-            let highestModseq = section[1] && typeof section[1].value === 'string' && !isNaN(section[1].value) ? BigInt(section[1].value) : false;
+            // Bounded digit runs only: isNaN() also passes '1e5', which BigInt() rejects with
+            // a throw that the catch below would swallow, making messageDelete() report false
+            // even though the server expunged the messages.
+            let highestModseq = parseBigIntValue(section[1] && section[1].value);
             if (highestModseq && (!connection.mailbox.highestModseq || highestModseq > connection.mailbox.highestModseq)) {
                 connection.mailbox.highestModseq = highestModseq;
             }

package/lib/commands/fetch.js

@@ -235,7 +235,9 @@ module.exports = async (connection, range, query, options) => {
                 // If server provides a throttleReset hint, use that if longer.
                 const backoffDelay = Math.min(baseDelay * Math.pow(2, retryCount), 30000); // Cap at 30 seconds
 
-                // Use throttle reset time if provided and longer than backoff
+                // Use throttle reset time if provided and longer than backoff. The hint is
+                // server-controlled, so the wait goes through connection.throttleWait(), which caps
+                // it and keeps the timer tracked and abortable.
                 const delay = err.throttleReset && err.throttleReset > backoffDelay ? err.throttleReset : backoffDelay;
 
                 connection.log.warn({
@@ -248,8 +250,12 @@ module.exports = async (connection, range, query, options) => {
                     delayMs: delay
                 });
 
-                // Wait before retrying
-                await new Promise(resolve => setTimeout(resolve, delay));
+                // An aborted wait means the client was closed, so give up rather than reissuing
+                // the FETCH on a connection that is already gone.
+                let aborted = await connection.throttleWait(delay);
+                if (aborted) {
+                    throw connection.createNoConnectionError(connection.byeReason);
+                }
 
                 retryCount++;
                 continue;

package/lib/commands/list.js

@@ -1,6 +1,16 @@
 'use strict';
 
-const { decodePath, encodePath, normalizePath, enhanceCommandError, hasCapability, isRev2Active, buildStatusQueryAttributes } = require('../tools.js');
+const {
+    decodePath,
+    encodePath,
+    normalizePath,
+    enhanceCommandError,
+    hasCapability,
+    isRev2Active,
+    buildStatusQueryAttributes,
+    getStringList
+} = require('../tools.js');
+const { parseStatusList } = require('./status-fields.js');
 const { specialUse } = require('../special-use');
 
 /**
@@ -133,7 +143,9 @@ module.exports = async (connection, reference, mailbox, options) => {
         // User-provided hints map mailbox paths to special-use types (e.g., {sent: "Sent Items"}).
         // These override server-reported flags and name-based guesses. Converted to a
         // path-keyed lookup: { "Sent Items" => "\\Sent" }
-        let specialUseHints = {};
+        // Keyed by server-supplied mailbox paths further down, so a null prototype keeps a
+        // path like "constructor" from resolving to an inherited member on lookup
+        let specialUseHints = Object.create(null);
         if (options.specialUseHints && typeof options.specialUseHints === 'object') {
             for (let type of Object.keys(options.specialUseHints)) {
                 if (
@@ -170,7 +182,7 @@ module.exports = async (connection, reference, mailbox, options) => {
                             // Decode from modified UTF-7 wire format and normalize the path
                             path: normalizePath(connection, decodePath(connection, (untagged.attributes[2] && untagged.attributes[2].value) || '')),
                             pathAsListed: (untagged.attributes[2] && untagged.attributes[2].value) || '',
-                            flags: new Set(untagged.attributes[0].map(entry => entry.value)),
+                            flags: new Set(getStringList(untagged.attributes[0])),
                             delimiter: untagged.attributes[1] && untagged.attributes[1].value,
                             listed: true
                         };
@@ -236,41 +248,9 @@ module.exports = async (connection, reference, mailbox, options) => {
                             return;
                         }
 
-                        const STATUS_FIELD_MAP = {
-                            MESSAGES: { key: 'messages', parser: Number },
-                            RECENT: { key: 'recent', parser: Number },
-                            UIDNEXT: { key: 'uidNext', parser: Number },
-                            UIDVALIDITY: { key: 'uidValidity', parser: BigInt },
-                            UNSEEN: { key: 'unseen', parser: Number },
-                            HIGHESTMODSEQ: { key: 'highestModseq', parser: BigInt },
-                            // IMAP4rev2 additions (RFC 9051): mailbox size and \Deleted count
-                            SIZE: { key: 'size', parser: Number },
-                            DELETED: { key: 'deleted', parser: Number }
-                        };
-
-                        let key;
                         let map = { path: statusPath };
-
-                        statusList.forEach((entry, i) => {
-                            if (i % 2 === 0) {
-                                key = entry && typeof entry.value === 'string' ? entry.value : false;
-                                return;
-                            }
-                            if (!key || !entry || typeof entry.value !== 'string') {
-                                return;
-                            }
-
-                            const fieldConfig = STATUS_FIELD_MAP[key.toUpperCase()];
-                            if (!fieldConfig) {
-                                return;
-                            }
-
-                            const value = !isNaN(entry.value) ? fieldConfig.parser(entry.value) : false;
-                            if (value === false) {
-                                return;
-                            }
-
-                            map[fieldConfig.key] = value;
+                        parseStatusList(statusList, (key, value) => {
+                            map[key] = value;
                         });
 
                         statusMap.set(statusPath, map);
@@ -455,7 +435,7 @@ module.exports = async (connection, reference, mailbox, options) => {
                         let entry = {
                             path: normalizePath(connection, decodePath(connection, (untagged.attributes[2] && untagged.attributes[2].value) || '')),
                             pathAsListed: (untagged.attributes[2] && untagged.attributes[2].value) || '',
-                            flags: new Set(untagged.attributes[0].map(entry => entry.value)),
+                            flags: new Set(getStringList(untagged.attributes[0])),
                             delimiter: untagged.attributes[1] && untagged.attributes[1].value,
                             subscribed: true
                         };

package/lib/commands/namespace.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { hasCapability } = require('../tools.js');
+const { hasCapability, getStringList } = require('../tools.js');
 
 /**
  * Requests NAMESPACE info from the server.
@@ -95,7 +95,7 @@ async function getListPrefix(connection) {
                         return;
                     }
 
-                    map.flags = new Set(untagged.attributes[0].map(entry => entry.value));
+                    map.flags = new Set(getStringList(untagged.attributes[0]));
                     map.delimiter = untagged.attributes[1] && untagged.attributes[1].value;
                     map.prefix = (untagged.attributes[2] && untagged.attributes[2].value) || '';
                     if (map.delimiter && map.prefix.charAt(0) === map.delimiter) {

package/lib/commands/quota.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { encodePath, normalizePath, enhanceCommandError } = require('../tools.js');
+const { encodePath, normalizePath, enhanceCommandError, parseUintValue, isUnsafeKey } = require('../tools.js');
 
 /**
  * Requests quota information for a mailbox.
@@ -47,11 +47,19 @@ module.exports = async (connection, path) => {
                 return;
             }
 
-            let value = attribute && typeof attribute.value === 'string' && !isNaN(attribute.value) ? Number(attribute.value) : false;
+            // isNaN() also passes '1e5', ' 12 ' and 'Infinity', none of which is a usable octet count
+            let value = parseUintValue(attribute && attribute.value);
             if (value === false) {
                 return;
             }
 
+            // Resource names are server-controlled. This object is returned to the caller, so it
+            // keeps a normal prototype and unsafe names are dropped instead; the fixed fields
+            // must keep their values too.
+            if (isUnsafeKey(key) || key === 'path' || key === 'quotaroot') {
+                return;
+            }
+
             if (!map[key]) {
                 map[key] = {};
             }

package/lib/commands/search.js

@@ -1,6 +1,14 @@
 'use strict';
 
-const { enhanceCommandError, hasCapability, isValidSequenceValue } = require('../tools.js');
+const {
+    enhanceCommandError,
+    hasCapability,
+    isValidSequenceValue,
+    parseBigIntValue,
+    parseUintValue,
+    MAX_UINT32_DIGITS,
+    EXPANDED_RANGE_LIMIT
+} = require('../tools.js');
 const { searchCompiler } = require('../search-compiler.js');
 
 /**
@@ -48,27 +56,29 @@ function parseEsearchResponse(attrs) {
             continue;
         }
         switch (key) {
+            // COUNT is a plain message count; MIN and MAX are sequence numbers or UIDs. All
+            // three are bounded decimal runs - isNaN() would also admit '1e400' (Infinity)
             case 'COUNT': {
-                const n = Number(attrs[++i]?.value);
-                if (!isNaN(n)) result.count = n;
+                const n = parseUintValue(attrs[++i]?.value, MAX_UINT32_DIGITS);
+                if (n !== false) result.count = n;
                 break;
             }
             case 'MIN': {
-                const n = Number(attrs[++i]?.value);
-                if (!isNaN(n)) result.min = n;
+                const n = parseUintValue(attrs[++i]?.value, MAX_UINT32_DIGITS);
+                if (n !== false) result.min = n;
                 break;
             }
             case 'MAX': {
-                const n = Number(attrs[++i]?.value);
-                if (!isNaN(n)) result.max = n;
+                const n = parseUintValue(attrs[++i]?.value, MAX_UINT32_DIGITS);
+                if (n !== false) result.max = n;
                 break;
             }
             case 'MODSEQ': {
                 // RFC 7162 section 3.1.5: present when the SEARCH used a MODSEQ
                 // criterion on a CONDSTORE-enabled session. BigInt because
                 // mod-sequence values are unsigned 63-bit
-                const value = attrs[++i]?.value;
-                if (typeof value === 'string' && /^\d+$/.test(value)) result.modseq = BigInt(value);
+                const modseq = parseBigIntValue(attrs[++i]?.value);
+                if (modseq !== false) result.modseq = modseq;
                 break;
             }
             case 'ALL': {
@@ -192,11 +202,37 @@ module.exports = async (connection, query, options) => {
             untagged: {
                 SEARCH: async untagged => {
                     if (untagged && untagged.attributes && untagged.attributes.length) {
-                        untagged.attributes.forEach(attribute => {
-                            if (attribute && attribute.value && typeof attribute.value === 'string' && !isNaN(attribute.value)) {
-                                results.add(Number(attribute.value));
+                        let truncated = false;
+                        let discarded = false;
+                        for (let attribute of untagged.attributes) {
+                            // The result set is server-controlled and accumulated across
+                            // responses, so stop at the same absolute ceiling expandRange()
+                            // uses - a server streaming SEARCH responses could otherwise
+                            // grow the set until the process runs out of memory
+                            /* c8 ignore next 4 */ // reaching the ceiling needs 2^24 accumulated results, which no unit test can produce in reasonable time
+                            if (results.size >= EXPANDED_RANGE_LIMIT) {
+                                truncated = true;
+                                break;
                             }
-                        });
+                            // Same nz-number check the ESEARCH branch below applies. isNaN()
+                            // is not enough: it passes '1e400' (Infinity), '-3' and '2.5', and
+                            // a single one of those makes the sequence set compiled from this
+                            // result set invalid, failing the caller's whole follow-up command
+                            let value = attribute && typeof attribute.value === 'string' ? Number(attribute.value) : NaN;
+                            if (!isValidSequenceValue(value)) {
+                                discarded = true;
+                                continue;
+                            }
+                            results.add(value);
+                        }
+                        if (truncated || discarded) {
+                            connection.log.warn({
+                                msg: 'Invalid entries in the SEARCH result',
+                                truncated,
+                                discarded,
+                                cid: connection.id
+                            });
+                        }
                     }
                 },
 
@@ -222,7 +258,11 @@ module.exports = async (connection, query, options) => {
                         // not contain '*' at all (RFC 9051 section 4.1.1), so UID
                         // parts with '*' are dropped
                         let existsCount = () => (connection.mailbox && connection.mailbox.exists) || 0;
-                        let overBudget = () => results.size >= existsCount();
+                        // The mailbox EXISTS count is itself server-supplied and can be
+                        // absurdly large, so the budget is additionally capped at the same
+                        // absolute ceiling expandRange() uses - a hostile server cannot
+                        // bypass it by inflating EXISTS first
+                        let overBudget = () => results.size >= existsCount() || results.size >= EXPANDED_RANGE_LIMIT;
                         let resolveId = part => (part === '*' ? (options.uid ? 0 : existsCount()) : Number(part));
                         let truncated = false;
                         let discarded = false;

package/lib/commands/select.js

@@ -1,6 +1,57 @@
 'use strict';
 
-const { encodePath, normalizePath, enhanceCommandError } = require('../tools.js');
+const { encodePath, normalizePath, enhanceCommandError, parseBigIntValue, parseUintValue, getStringList, MAX_UINT32_DIGITS } = require('../tools.js');
+
+// Response codes carrying a value that SELECT/EXAMINE may write to the mailbox object, keyed by
+// the lowercased code, mapped to the fixed public property name and the parser for the value.
+// Every parser returns false for a value it cannot use, and the field is then left unset.
+//
+// This is an allowlist on purpose. The mailbox object is API surface: without one, an arbitrary
+// server-sent [KEY value] code could overwrite `path` (defeating the DELETE/RENAME guards that
+// compare paths) or `flags`, and a parenthesized value under "__proto__" would replace the
+// object's prototype. The lookup itself is on a null-prototype object for the same reason - the
+// key is lowercased, so "constructor" would otherwise resolve to an inherited member.
+const VALUED_RESPONSE_CODES = Object.assign(Object.create(null), {
+    // CONDSTORE (RFC 7162): highest mod-sequence value for the mailbox, used for incremental
+    // sync. Stored as a BigInt since modseq values can exceed Number.MAX_SAFE_INTEGER.
+    //
+    // A value that is not a bounded digit run is dropped rather than stored raw: every consumer
+    // compares highestModseq relationally, and a relational compare against a non-numeric string
+    // is false in both directions, so the value could never advance and delta sync would stop.
+    highestmodseq: { key: 'highestModseq', parse: value => parseBigIntValue(value) },
+
+    // Unique identifier validity. If this changes between sessions, all previously cached UIDs
+    // are invalid and the client must re-sync from scratch. Nominally 32-bit, but stored as a
+    // BigInt precisely so a server that exceeds that still round-trips, hence the wider bound.
+    uidvalidity: { key: 'uidValidity', parse: value => parseBigIntValue(value) },
+
+    // The next UID to be assigned in this mailbox, useful for detecting new arrivals. A huge
+    // digit run would coerce to Infinity and corrupt every later UID range computation.
+    uidnext: { key: 'uidNext', parse: value => parseUintValue(value, MAX_UINT32_DIGITS) },
+
+    // Sequence number of the first unseen message (RFC 3501 section 7.1). Not a count of unseen
+    // messages - use mailboxStatus() with {unseen: true} for that.
+    unseen: { key: 'unseen', parse: value => parseUintValue(value, MAX_UINT32_DIGITS) },
+
+    // APPENDLIMIT (RFC 7889): largest message size in octets the server accepts for APPEND into
+    // this mailbox. Spelled all lowercase, unlike the camelCase fields around it, because that is
+    // the name this object has always exposed.
+    appendlimit: { key: 'appendlimit', parse: value => parseUintValue(value) },
+
+    // OBJECTID (RFC 8474): server-assigned mailbox identifier that survives renames. Sent as a
+    // parenthesized list, but servers in the wild send it bare too.
+    mailboxid: {
+        key: 'mailboxId',
+        parse: value => (Array.isArray(value) ? value.length > 0 && value[0] : typeof value === 'string' && value)
+    },
+
+    // Flags the client may change permanently on messages in this mailbox, including \* if the
+    // server allows custom flags. Only the parenthesized form carries flags, and a malformed
+    // value must leave permanentFlags unset rather than set an empty Set: canUseFlag() reads
+    // unset as permissive and empty as deny-all, so an empty Set would turn every later flag
+    // update into a silent no-op for the rest of the session.
+    permanentflags: { key: 'permanentFlags', parse: value => Array.isArray(value) && new Set(value) }
+});
 
 /**
  * Selects or examines a mailbox, making it the current mailbox for subsequent operations.
@@ -92,78 +143,33 @@ module.exports = async (connection, path, options) => {
                     }
                     let section = !untagged.attributes[0].value && untagged.attributes[0].section;
                     // Handle response codes with a key-value pair (section has 2+ elements)
-                    if (section && section.length > 1 && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
+                    if (section && section.length > 1 && section[0] && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
                         let key = section[0].value.toLowerCase();
                         let value;
 
-                        // Value can be a single string or a list of strings (e.g., PERMANENTFLAGS)
-                        if (typeof section[1].value === 'string') {
+                        // Value can be a single string or a list of strings (e.g., PERMANENTFLAGS).
+                        // section[1] can be a parsed NIL (null), and so can any element inside a
+                        // parenthesized list, so both levels need the guard
+                        if (section[1] && typeof section[1].value === 'string') {
                             value = section[1].value;
                         } else if (Array.isArray(section[1])) {
-                            value = section[1].map(entry => (typeof entry.value === 'string' ? entry.value : false)).filter(entry => entry);
+                            value = getStringList(section[1]);
                         }
 
-                        switch (key) {
-                            // CONDSTORE (RFC 7162): highest mod-sequence value for the mailbox.
-                            // Used for incremental sync -- clients compare against their cached
-                            // value to detect changes. Stored as BigInt since modseq values
-                            // can exceed Number.MAX_SAFE_INTEGER.
-                            case 'highestmodseq':
-                                key = 'highestModseq';
-                                if (/^[0-9]+$/.test(value)) {
-                                    value = BigInt(value);
-                                }
-                                break;
-
-                            // OBJECTID (RFC 8474): server-assigned unique mailbox identifier.
-                            // Unlike path, this ID survives renames. Value comes as a
-                            // parenthesized list, so extract the first (only) element.
-                            case 'mailboxid':
-                                key = 'mailboxId';
-                                if (Array.isArray(value) && value.length) {
-                                    value = value[0];
-                                }
-                                break;
-
-                            // Flags that the client can change permanently on messages in
-                            // this mailbox. Includes \* if the server allows custom flags.
-                            case 'permanentflags':
-                                key = 'permanentFlags';
-                                value = new Set(value);
-                                break;
-
-                            // The next UID that will be assigned to a new message in this
-                            // mailbox. Useful for detecting new arrivals.
-                            case 'uidnext':
-                                key = 'uidNext';
-                                value = Number(value);
-                                break;
-
-                            // Unique identifier validity value. If this changes between
-                            // sessions, all previously cached UIDs are invalid and the
-                            // client must re-sync from scratch.
-                            case 'uidvalidity':
-                                key = 'uidValidity';
-                                if (/^[0-9]+$/.test(value)) {
-                                    value = BigInt(value);
-                                }
-                                break;
+                        let field = VALUED_RESPONSE_CODES[key];
+                        if (field) {
+                            let parsed = field.parse(value);
+                            if (parsed !== false) {
+                                map[field.key] = parsed;
+                            }
                         }
-
-                        map[key] = value;
                     }
 
-                    // Handle response codes with only a keyword (no value), e.g., [NOMODSEQ]
-                    if (section && section.length === 1 && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
-                        let key = section[0].value.toLowerCase();
-                        switch (key) {
-                            // NOMODSEQ means the mailbox does not support mod-sequences.
-                            // CONDSTORE/QRESYNC features are unavailable for this mailbox.
-                            case 'nomodseq':
-                                key = 'noModseq';
-                                map[key] = true;
-                                break;
-                        }
+                    // Handle response codes with only a keyword (no value), e.g., [NOMODSEQ].
+                    // NOMODSEQ means the mailbox does not support mod-sequences, so the
+                    // CONDSTORE/QRESYNC features are unavailable for it.
+                    if (section && section.length === 1 && section[0] && section[0].type === 'ATOM' && section[0].value?.toUpperCase() === 'NOMODSEQ') {
+                        map.noModseq = true;
                     }
                 },
 
@@ -173,15 +179,16 @@ module.exports = async (connection, path, options) => {
                     if (!untagged.attributes || !untagged.attributes.length || !Array.isArray(untagged.attributes[0])) {
                         return;
                     }
-                    let flags = untagged.attributes[0].map(flag => (typeof flag.value === 'string' ? flag.value : false)).filter(flag => flag);
-                    map.flags = new Set(flags);
+                    map.flags = new Set(getStringList(untagged.attributes[0]));
                 },
 
                 // Untagged EXISTS response: "* <count> EXISTS" tells us the total number
                 // of messages in the mailbox. The count is in the command field (numeric prefix).
                 EXISTS: async untagged => {
-                    let num = Number(untagged.command);
-                    if (isNaN(num)) {
+                    // Not a usable count: anything but a bounded digit run. A long digit run
+                    // coerces to Infinity, which would corrupt every later range computation
+                    let num = parseUintValue(untagged.command, MAX_UINT32_DIGITS);
+                    if (num === false) {
                         return false;
                     }
 
@@ -204,9 +211,13 @@ module.exports = async (connection, path, options) => {
         });
 
         // The tagged OK response to SELECT/EXAMINE includes [READ-ONLY] or [READ-WRITE]
-        // in its response code, indicating the access mode the server granted.
-        let section = !response.response.attributes[0].value && response.response.attributes[0].section;
-        if (section && section.length && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
+        // in its response code, indicating the access mode the server granted. A tagged OK
+        // with no resp-text has no `attributes` property at all, and unlike the untagged
+        // handlers above this runs in the command body, where a throw would tear down the
+        // mailbox state the server has actually selected.
+        let okAttributes = (response.response && response.response.attributes) || [];
+        let section = okAttributes[0] && !okAttributes[0].value && okAttributes[0].section;
+        if (section && section.length && section[0] && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
             map.readOnly = section[0].value.toUpperCase() === 'READ-ONLY';
         }