imapflow 1.6.4 → 1.6.6

package/lib/handler/limits.js

@@ -12,16 +12,28 @@ const MAX_LITERAL_SIZE = 1024 * 1024 * 1024;
 // only to stop a server that never sends a line terminator, not to constrain normal traffic.
 const MAX_LINE_SIZE = MAX_LITERAL_SIZE;
 
+// Default maximum total size of a single assembled response: every line segment and literal of
+// one response combined. The per-line and per-literal caps alone cannot stop a server that
+// spreads attacker-controlled bytes across an unbounded number of tokens of a single response
+// (e.g. one FETCH answer carrying many maximum-size literals).
+//
+// Deliberately above the literal cap: the response total also carries the literal's marker line
+// and the rest of the response framing, so a cap equal to MAX_LITERAL_SIZE would make a literal
+// of exactly the maximum permitted size impossible to receive. Configuring both limits calls for
+// the same headroom - set maxResponseSize above maxLiteralSize, not equal to it.
+const MAX_RESPONSE_SIZE = 2 * MAX_LITERAL_SIZE;
+
 /**
  * Normalizes a configured size limit. A non-negative integer is honored as-is (including 0, which
- * means "reject anything non-empty"); anything else falls back to the default, so an explicit 0 is
- * not silently swallowed the way `value || DEFAULT` would swallow it.
+ * means "reject anything non-empty"), and `Infinity` disables the limit; anything else falls back
+ * to the default, so an explicit 0 is not silently swallowed the way `value || DEFAULT` would
+ * swallow it.
  *
  * @param {*} value - The configured value.
  * @param {number} defaultValue - Fallback when the value is not a usable limit.
  * @returns {number} The normalized limit.
  */
-const normalizeLimit = (value, defaultValue) => (Number.isInteger(value) && value >= 0 ? value : defaultValue);
+const normalizeLimit = (value, defaultValue) => ((Number.isInteger(value) || value === Infinity) && value >= 0 ? value : defaultValue);
 
 /**
  * Builds the `LiteralTooLarge` error. One shape for every place a literal is refused, so callers
@@ -40,4 +52,4 @@ const createLiteralTooLargeError = (literalSize, maxSize, reason) => {
     return err;
 };
 
-module.exports = { MAX_LITERAL_SIZE, MAX_LINE_SIZE, normalizeLimit, createLiteralTooLargeError };
+module.exports = { MAX_LITERAL_SIZE, MAX_LINE_SIZE, MAX_RESPONSE_SIZE, normalizeLimit, createLiteralTooLargeError };

package/lib/imap-flow.d.ts

@@ -85,18 +85,34 @@ export interface ImapFlowOptions {
      * Maximum allowed length in bytes of a single response line (a response without a literal).
      * Guards against a malicious or broken server that never sends a line terminator. Defaults to
      * 1GB. The line terminator counts towards the limit and a line exactly at the limit is
-     * accepted. Exceeding it is terminal: the connection fails with error code `LineTooLarge` and
+     * accepted. `Infinity` disables the limit. An in-progress line is additionally bounded by
+     * whatever is left of `maxResponseSize`, so lowering that also bounds line buffering.
+     * Exceeding it is terminal: the connection fails with error code `LineTooLarge` and
      * no further input is parsed.
      */
     maxLineLength?: number;
     /**
      * Maximum allowed size in bytes of a single IMAP literal block. Bounds peak memory allocation
      * against a malicious or broken server announcing an oversized literal. Defaults to 1GB. A
-     * literal exactly at the limit is accepted. Exceeding it is terminal: the connection fails
+     * literal exactly at the limit is accepted, provided `maxResponseSize` leaves room for the
+     * marker line as the defaults do. `Infinity` disables the limit. Exceeding it is terminal: the connection fails
      * with error code `LiteralTooLarge`, and neither the marker line nor any byte of the rejected
      * literal is interpreted as protocol.
      */
     maxLiteralSize?: number;
+    /**
+     * Maximum allowed total size in bytes of a single assembled IMAP response (every line
+     * segment and literal of one response combined). Bounds peak memory allocation against
+     * a malicious or broken server that spreads response data across an unbounded number of
+     * tokens, which the per-line and per-literal caps alone cannot stop. Defaults to 2GB,
+     * which is above the default literal cap on purpose: the total also carries the literal
+     * marker line and the rest of the response framing, so a value equal to `maxLiteralSize`
+     * would make a literal of exactly the maximum permitted size impossible to receive. Set
+     * this above `maxLiteralSize` when configuring both. `Infinity` disables the limit.
+     * Exceeding it is terminal: the connection fails with error code `ResponseTooLarge` and
+     * no further input is parsed.
+     */
+    maxResponseSize?: number;
     /**
      * Threshold in milliseconds for warning that a mailbox lock has been held
      * for a long time (diagnostic for forgotten release() calls). Defaults to
@@ -145,6 +161,10 @@ export interface MailboxObject {
     uidNext: number;
     /** Messages in this folder */
     exists: number;
+    /** Sequence number of the first unseen message, if the server reported [UNSEEN] on SELECT. Not a count of unseen messages - use mailboxStatus() with {unseen: true} for that */
+    unseen?: number;
+    /** Largest message size in octets the server accepts for APPEND into this mailbox, if it reported [APPENDLIMIT] (RFC 7889) */
+    appendlimit?: number;
     /** Read-only state */
     readOnly?: boolean;
 }

package/lib/imap-flow.js

@@ -12,7 +12,7 @@ const logger = require('./logger');
 const libmime = require('libmime');
 const zlib = require('zlib');
 const { Headers } = require('@zone-eu/mailsplit');
-const { LimitedPassthrough } = require('./limited-passthrough');
+const { LimitedPassthrough, normalizeByteLimit } = require('./limited-passthrough');
 
 const { ImapStream } = require('./handler/imap-stream');
 const { parser, compiler } = require('./handler/imap-handler');
@@ -38,7 +38,11 @@ const {
     AuthenticationFailure,
     getColorFlags,
     hasCapability,
-    unrefTimer
+    unrefTimer,
+    parseUintValue,
+    isUnsafeKey,
+    getStringList,
+    MAX_UINT32_DIGITS
 } = require('./tools');
 
 const imapCommands = require('./imap-commands.js');
@@ -50,6 +54,10 @@ const UPGRADE_TIMEOUT = 10 * 1000;
 
 const SOCKET_TIMEOUT = 5 * 60 * 1000;
 
+// Ceiling for any throttle back-off wait. Both the connection-level back-off and the per-command
+// retries derive their delay from server-supplied hints, which are unbounded.
+const MAX_THROTTLE_DELAY = 5 * 60 * 1000;
+
 // Default threshold for warning that a mailbox lock has been held for a long
 // time. Intended to catch forgotten release() calls, not legitimate long ops
 // (e.g. fetching hundreds of thousands of messages). Configurable via the
@@ -323,17 +331,18 @@ class ImapFlow extends EventEmitter {
             logRaw: this.logRaw,
             secureConnection: this.secureConnection,
             maxLineLength: this.options.maxLineLength,
-            maxLiteralSize: this.options.maxLiteralSize
+            maxLiteralSize: this.options.maxLiteralSize,
+            maxResponseSize: this.options.maxResponseSize
         });
 
         this.reading = false;
         this.socket = false;
         this.writeSocket = false;
 
-        // Tracked throttle back-off timer (see reader()). Stored so close() can clear it
-        // and abort the wait instead of letting it keep the event loop alive for minutes.
-        this._throttleTimer = null;
-        this._throttleAbort = null;
+        // In-flight throttle back-offs (see throttleWait()). Tracked as a set because more than
+        // one can be pending at a time: the reader's connection-level back-off and a command
+        // retrying its own throttled request. close() clears them all.
+        this._throttleWaits = new Set();
 
         // Pending rejector of the in-flight STARTTLS upgrade promise (see upgradeToSTARTTLS()).
         // Stored so emitError() can route a streamer-originated error into the upgrade's single
@@ -643,22 +652,40 @@ class ImapFlow extends EventEmitter {
         }
 
         if (typeof options.onSend === 'function') {
-            options.onSend();
+            // The command is already on the wire, so a throwing onSend callback must not
+            // reach trySend()'s catch - that would reject the request and dispatch the
+            // next command into the server's pending state for this one.
+            try {
+                options.onSend();
+            } catch (err) {
+                this.log.warn({ err, cid: this.id });
+            }
         }
     }
 
     async trySend() {
-        if (this.currentRequest || !this.requestQueue.length) {
-            return;
-        }
-        this.currentRequest = this.requestQueue.shift();
+        while (!this.currentRequest && this.requestQueue.length) {
+            this.currentRequest = this.requestQueue.shift();
 
-        await this.send({
-            tag: this.currentRequest.tag,
-            command: this.currentRequest.command,
-            attributes: this.currentRequest.attributes,
-            options: this.currentRequest.options
-        });
+            try {
+                await this.send({
+                    tag: this.currentRequest.tag,
+                    command: this.currentRequest.command,
+                    attributes: this.currentRequest.attributes,
+                    options: this.currentRequest.options
+                });
+                return;
+            } catch (err) {
+                // A failure here (most likely the compiler refusing an invalid
+                // user-supplied value) belongs to the command that was being dispatched.
+                // Without this the shifted request would stay currentRequest forever:
+                // nothing reached the wire, so no tagged response ever clears it, and
+                // every later command would queue behind it until the socket timeout.
+                // Reject the failed command and keep draining the queue.
+                this.commandParts = [];
+                this.rejectCurrentRequest(err);
+            }
+        }
     }
 
     exec(command, attributes, options) {
@@ -685,10 +712,10 @@ class ImapFlow extends EventEmitter {
         let promise = new Promise((resolve, reject) => {
             this.requestTagMap.set(tag, { command, attributes, options, resolve, reject });
             this.requestQueue.push({ tag, command, attributes, options });
-            this.trySend().catch(err => {
-                this.requestTagMap.delete(tag);
-                reject(err);
-            });
+            // trySend() settles dispatch failures itself, by rejecting the affected
+            // command through requestTagMap; this catch exists only so a throw from the
+            // dispatch machinery itself can never surface as a floating rejection.
+            this.trySend().catch(err => this.log.warn({ err, cid: this.id }));
         });
 
         // Prevent unhandled promise rejection if close() rejects this request
@@ -798,6 +825,32 @@ class ImapFlow extends EventEmitter {
         }
     }
 
+    /**
+     * Waits out a throttle back-off.
+     *
+     * The delay is capped at MAX_THROTTLE_DELAY because it can come straight from a server hint
+     * (a Microsoft 365 "Suggested Backoff Time", say) and an uncapped hint would park the caller
+     * for weeks. The timer is unref'd and tracked so it can never outlive the client: a bare
+     * setTimeout here keeps a short-lived process alive for the full delay after close(), and
+     * leaves the caller waiting on a connection that is already gone.
+     *
+     * @param {Number} delay - Requested delay in milliseconds.
+     * @returns {Promise<Boolean>} True if close() aborted the wait, false on normal expiry.
+     */
+    async throttleWait(delay) {
+        delay = Math.min(Math.max(Number(delay) || 0, 0), MAX_THROTTLE_DELAY);
+
+        return await new Promise(resolve => {
+            let entry = { resolve };
+            entry.timer = setTimeout(() => {
+                this._throttleWaits.delete(entry);
+                resolve(false);
+            }, delay);
+            unrefTimer(entry.timer);
+            this._throttleWaits.add(entry);
+        });
+    }
+
     async reader() {
         let data;
         let processedCount = 0;
@@ -848,8 +901,17 @@ class ImapFlow extends EventEmitter {
             return;
         }
 
-        let tag = payload.toString('latin1', 0, 64).match(/^(\S+)/);
-        if (!tag || tag[1] !== this.currentRequest.tag) {
+        // Prefer the tag the parser had already extracted before it failed - it went
+        // through the same leading-NUL workaround as every parsed response. Fall back
+        // to the raw bytes for lines whose tag itself was unparseable: skip the NUL
+        // padding buggy servers prepend and stop at the first byte a tag cannot contain.
+        let tag = parserError && parserError.parsedTag;
+        if (!tag) {
+            // eslint-disable-next-line no-control-regex
+            let match = payload.toString('latin1', 0, 64).match(/^\0*([^\s\x00-\x1f\x7f]+)/);
+            tag = match && match[1];
+        }
+        if (!tag || tag !== this.currentRequest.tag) {
             return;
         }
 
@@ -873,23 +935,11 @@ class ImapFlow extends EventEmitter {
 
         try {
             parsed = await parser(data.payload, { literals: data.literals });
-            if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
-                let payload = { response: parsed.command };
-
-                if (
-                    parsed.attributes &&
-                    parsed.attributes[0] &&
-                    parsed.attributes[0].section &&
-                    parsed.attributes[0].section[0] &&
-                    parsed.attributes[0].section[0].type === 'ATOM'
-                ) {
-                    payload.code = parsed.attributes[0].section[0].value;
-                }
-                this.emit('response', payload);
-            }
         } catch (err) {
-            // can not make sense of this
-            this.log.error({ src: 's', msg: data.payload.toString(), err, cid: this.id });
+            // can not make sense of this. The payload can be up to the configured line
+            // cap (1GB by default), so log only a bounded prefix: a server looping
+            // unparseable garbage would otherwise turn this error log into a disk filler.
+            this.log.error({ src: 's', msg: data.payload.toString('latin1', 0, 1024), payloadBytes: data.payload.length, err, cid: this.id });
             // An unparseable untagged line is junk that can be skipped, but the line may
             // have been the in-flight command's tagged completion. Dropping that one
             // silently strands the command: currentRequest is never cleared, so trySend()
@@ -901,6 +951,28 @@ class ImapFlow extends EventEmitter {
             return true;
         }
 
+        if (parsed.tag && !['*', '+'].includes(parsed.tag) && parsed.command) {
+            let payload = { response: parsed.command };
+
+            if (
+                parsed.attributes &&
+                parsed.attributes[0] &&
+                parsed.attributes[0].section &&
+                parsed.attributes[0].section[0] &&
+                parsed.attributes[0].section[0].type === 'ATOM'
+            ) {
+                payload.code = parsed.attributes[0].section[0].value;
+            }
+            // Outside the parse try/catch on purpose: a throwing user 'response' listener
+            // is not a parse failure and must not settle the in-flight command or fail the
+            // connection - the same contract untagged handlers get.
+            try {
+                this.emit('response', payload);
+            } catch (err) {
+                this.log.warn({ err, cid: this.id });
+            }
+        }
+
         let logCompiled = await compiler(parsed, {
             isLogging: true
         });
@@ -939,7 +1011,9 @@ class ImapFlow extends EventEmitter {
         }
 
         let section = parsed.attributes && parsed.attributes.length && parsed.attributes[0] && !parsed.attributes[0].value && parsed.attributes[0].section;
-        if (section && section.length && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
+        // section[0] can be a parsed NIL (null), e.g. from a "[NIL]" response code - the
+        // dereference must be guarded or one such line tears down the whole connection
+        if (section && section.length && section[0] && section[0].type === 'ATOM' && typeof section[0].value === 'string') {
             let sectionHandler = this.getSectionHandler(section[0].value.toUpperCase().trim());
             if (sectionHandler) {
                 try {
@@ -1089,27 +1163,12 @@ class ImapFlow extends EventEmitter {
                         err.code = 'ETHROTTLE';
                         err.throttleReset = throttleDelay;
 
-                        let delayResponse = throttleDelay;
-                        if (delayResponse > 5 * 60 * 1000) {
-                            // Cap wait at 5 minutes to avoid hanging connections indefinitely.
-                            // The server-suggested delay can be very large.
-                            delayResponse = 5 * 60 * 1000;
-                        }
+                        // The server-suggested delay can be very large, so throttleWait() caps it
+                        let delayResponse = Math.min(throttleDelay, MAX_THROTTLE_DELAY);
 
                         this.log.warn({ msg: 'Throttling detected', cid: this.id, throttleDelay, delayResponse, err });
 
-                        // Tracked, abortable wait. Storing the timer lets close() clear it so
-                        // the back-off never keeps the event loop alive, and storing the resolve
-                        // lets close() abort the wait promptly (aborted=true) instead of blocking
-                        // the reader for up to 5 minutes and rejecting long after the connection
-                        // is gone. Normal expiry resolves with aborted=false.
-                        let aborted = await new Promise(resolve => {
-                            this._throttleAbort = resolve;
-                            this._throttleTimer = setTimeout(() => resolve(false), delayResponse);
-                            unrefTimer(this._throttleTimer);
-                        });
-                        this._throttleTimer = null;
-                        this._throttleAbort = null;
+                        let aborted = await this.throttleWait(delayResponse);
 
                         if (aborted) {
                             // Connection closed during back-off: reject promptly with a
@@ -1536,6 +1595,12 @@ class ImapFlow extends EventEmitter {
             let opts = Object.assign(
                 {
                     socket: this.socket,
+                    // host is required even though the socket is already connected: without
+                    // it, a connection made to an IP literal (servername=false) has its
+                    // certificate verified against Node's fallback name "localhost" instead
+                    // of the IP - accepting any "localhost" certificate for any IP-hosted
+                    // server, and rejecting legitimate IP-SAN certificates.
+                    host: this.host,
                     servername: this.servername,
                     port: this.port
                 },
@@ -1672,8 +1737,7 @@ class ImapFlow extends EventEmitter {
             // STARTTLS OK itself clears expectCapabilityUpdate, so keying the discard
             // on that flag would keep exactly the pre-TLS list an attacker controls -
             // the list that then picks the AUTH mechanism and answers LOGINDISABLED.
-            this.capabilities.clear();
-            this.authCapabilities.clear();
+            this.clearCapabilities();
             await this.run('CAPABILITY');
         }
 
@@ -1818,6 +1882,17 @@ class ImapFlow extends EventEmitter {
         this.state = this.states.LOGOUT;
     }
 
+    // Drops every capability-derived field together - the counterpart of
+    // updateCapabilitiesFromRaw() below, which sets them together. rawCapabilities is
+    // public surface external consumers read, so a discard (RFC 9051 6.2.1 requires
+    // one after STARTTLS) that missed it would leave the stale list visible if the
+    // re-fetch fails.
+    clearCapabilities() {
+        this.capabilities.clear();
+        this.authCapabilities.clear();
+        this.rawCapabilities = null;
+    }
+
     updateCapabilitiesFromRaw(rawCapabilities) {
         this.rawCapabilities = rawCapabilities;
         this.capabilities = updateCapabilities(rawCapabilities);
@@ -1849,11 +1924,18 @@ class ImapFlow extends EventEmitter {
             return;
         }
 
-        if (!untagged || !untagged.command || isNaN(untagged.command)) {
+        if (!untagged) {
             return;
         }
 
-        let count = Number(untagged.command);
+        // Not a usable count: anything but a bounded digit run. A digit run long enough
+        // coerces to Infinity, which would corrupt mailbox state (resolveRange('*') would
+        // compile to the literal "Infinity" and every range-based command would fail until
+        // the next SELECT)
+        let count = parseUintValue(untagged.command, MAX_UINT32_DIGITS);
+        if (count === false) {
+            return;
+        }
         if (count === this.mailbox.exists) {
             // nothing changed?
             return;
@@ -1875,11 +1957,12 @@ class ImapFlow extends EventEmitter {
             return;
         }
 
-        if (!untagged || !untagged.command || isNaN(untagged.command)) {
+        if (!untagged) {
             return;
         }
 
-        let seq = Number(untagged.command);
+        // Same bound untaggedExists() applies: only a bounded decimal run is a usable sequence number
+        let seq = parseUintValue(untagged.command, MAX_UINT32_DIGITS);
         if (seq && seq <= this.mailbox.exists) {
             this.mailbox.exists--;
             let payload = {
@@ -1910,8 +1993,14 @@ class ImapFlow extends EventEmitter {
         let tags = [];
         let uids = false;
 
+        // A malformed VANISHED can carry no attributes at all, and one carrying only the
+        // (EARLIER) tag leaves `uids` false - expandRange() handles that and yields nothing
+        if (!untagged.attributes || !untagged.attributes.length) {
+            return;
+        }
+
         if (untagged.attributes.length > 1 && Array.isArray(untagged.attributes[0])) {
-            tags = untagged.attributes[0].map(entry => (typeof entry.value === 'string' ? entry.value.toUpperCase() : false)).filter(value => value);
+            tags = getStringList(untagged.attributes[0]).map(value => value.toUpperCase());
             untagged.attributes.shift();
         }
 
@@ -2275,14 +2364,13 @@ class ImapFlow extends EventEmitter {
             clearTimeout(this.connectTimeout);
             clearTimeout(this.greetingTimeout);
 
-            // Abort any in-flight throttle back-off so the reader unblocks and the
-            // throttled request is rejected promptly rather than after the full delay.
-            clearTimeout(this._throttleTimer);
-            this._throttleTimer = null;
-            if (typeof this._throttleAbort === 'function') {
-                this._throttleAbort(true);
-                this._throttleAbort = null;
+            // Abort every in-flight throttle back-off so each waiter unblocks and its request is
+            // settled promptly rather than after the full delay.
+            for (let entry of this._throttleWaits) {
+                clearTimeout(entry.timer);
+                entry.resolve(true);
             }
+            this._throttleWaits.clear();
 
             this.usable = false;
             // close() takes over ownership of the idling state: dropping the session token means a
@@ -3548,7 +3636,8 @@ class ImapFlow extends EventEmitter {
         let processed = 0;
 
         let chunkSize = Number(options.chunkSize) || 64 * 1024;
-        let maxBytes = Number(options.maxBytes) || Infinity;
+        // Normalized once here so every bounded stage of the pipeline below agrees on the budget
+        let maxBytes = normalizeByteLimit(options.maxBytes);
 
         let uid = false;
 
@@ -3738,24 +3827,43 @@ class ImapFlow extends EventEmitter {
                 output = stream = new PassThrough();
         }
 
+        // Every byte-bounded stage of the pipeline. The fetch loop below stops as soon as any of
+        // them has taken all it will accept. The limiter at the tail is not enough on its own: a
+        // transform in the middle that buffers its whole input before emitting anything (the
+        // format=flowed decoder, the Japanese charset decoder) leaves the tail limiter reporting
+        // `limited === false` however much the server sends, so a download with a small maxBytes
+        // would still pull the entire part off the wire.
+        let limiters = [];
+        let isLimited = () => limiters.some(entry => entry.limited);
+
+        // Appending a stage means forwarding the current tail's errors to it before piping, so a
+        // failure anywhere reaches the stream the caller is reading
+        let pipeStage = stage => {
+            output.on('error', err => {
+                stage.emit('error', err);
+            });
+            output = output.pipe(stage);
+            return stage;
+        };
+
         let isTextNode = ['text/html', 'text/plain', 'text/x-amp-html'].includes(meta.contentType) || (part === '1' && !meta.contentType);
         if ((!meta.disposition || meta.disposition === 'inline') && isTextNode) {
             // RFC 3676 format=flowed text: unwrap soft line breaks
             if (meta.flowed) {
-                let flowDecoder = new FlowedDecoder({
-                    delSp: meta.delSp
-                });
-                output.on('error', err => {
-                    flowDecoder.emit('error', err);
-                });
-                output = output.pipe(flowDecoder);
+                // FlowedDecoder buffers its whole input before emitting, and being third party it
+                // carries no bound of its own, so bound what it can ever be handed. Unwrapping only
+                // removes bytes, so capping its input at maxBytes cannot push the delivered output
+                // above the cap either.
+                limiters.push(pipeStage(new LimitedPassthrough({ maxBytes })));
+
+                pipeStage(new FlowedDecoder({ delSp: meta.delSp }));
             }
 
             // Convert non-UTF-8 charsets to UTF-8 via a streaming decoder.
             // ASCII and UTF-8 need no conversion. Unknown charsets are left as-is.
             if (meta.charset && !['ascii', 'usascii', 'utf8'].includes(meta.charset.toLowerCase().replace(/[^a-z0-9]+/g, ''))) {
                 try {
-                    let decoder = getDecoder(meta.charset);
+                    let decoder = getDecoder(meta.charset, maxBytes);
                     // Safety listener attached first so the decoder always has at least
                     // one 'error' listener. Prevents Node.js from throwing
                     // ERR_UNHANDLED_ERROR if a later pipe setup step throws and leaves
@@ -3765,10 +3873,10 @@ class ImapFlow extends EventEmitter {
                     decoder.on('error', err => {
                         this.log.warn({ err, charset: meta.charset, cid: this.id });
                     });
-                    output.on('error', err => {
-                        decoder.emit('error', err);
-                    });
-                    output = output.pipe(decoder);
+                    // The Japanese decoder buffers its whole input as well, and reports the same
+                    // `limited` flag the limiters do so the fetch loop can stop once it is full.
+                    // A streaming decoder has no such flag, which reads as false and is correct.
+                    limiters.push(pipeStage(decoder));
                     // force to utf-8 for output
                     meta.charset = 'utf-8';
                 } catch {
@@ -3777,11 +3885,8 @@ class ImapFlow extends EventEmitter {
             }
         }
 
-        let limiter = new LimitedPassthrough({ maxBytes });
-        output.on('error', err => {
-            limiter.emit('error', err);
-        });
-        output = output.pipe(limiter);
+        let limiter = pipeStage(new LimitedPassthrough({ maxBytes }));
+        limiters.push(limiter);
 
         // Cleanup function
         const cleanup = () => {
@@ -3796,7 +3901,7 @@ class ImapFlow extends EventEmitter {
         output.once('close', cleanup);
 
         let writeChunk = chunk => {
-            if (limiter.limited || fetchAborted || stream.destroyed) {
+            if (isLimited() || fetchAborted || stream.destroyed) {
                 return true;
             }
             return stream.write(chunk);
@@ -3806,7 +3911,7 @@ class ImapFlow extends EventEmitter {
         // Stops when the server returns a short chunk (< chunkSize), the byte
         // limiter is satisfied, or the consumer destroys the output stream.
         let fetchAllParts = async () => {
-            while (hasMore && !limiter.limited && !fetchAborted) {
+            while (hasMore && !isLimited() && !fetchAborted) {
                 let { chunk } = await getNextPart();
                 if (!chunk || fetchAborted) {
                     break;
@@ -3967,6 +4072,12 @@ class ImapFlow extends EventEmitter {
 
         for (let [part, content] of response.bodyParts) {
             let keyParts = part.split('.mime');
+            // The server chooses the BODY[...] keys it answers with: never let one be a
+            // prototype-chain name, or the assignments below write onto Object.prototype
+            // (process-wide pollution) instead of the result object.
+            if (isUnsafeKey(keyParts[0])) {
+                continue;
+            }
             if (keyParts.length === 1) {
                 // content
                 let key = keyParts[0];
@@ -4035,7 +4146,11 @@ class ImapFlow extends EventEmitter {
         }
 
         for (let part of Object.keys(data)) {
-            let meta = data[part].meta;
+            // `meta` is only built from the companion BODY[<part>.MIME] item. A server may
+            // legally answer with fewer items than were requested, and one part arriving
+            // without its MIME headers must not cost the caller the whole download.
+            let meta = data[part].meta || {};
+            data[part].meta = meta;
 
             // parts that arrived via FETCH BINARY (response.binaryParts) are already
             // decoded by the server - decoding again would corrupt the data