imapflow 1.6.5 → 1.6.6

package/lib/tools.js

@@ -11,11 +11,26 @@ const iconv = require('iconv-lite');
 
 const FLAG_COLORS = ['red', 'orange', 'yellow', 'green', 'blue', 'purple', 'grey'];
 
-// Upper bound for expanding a single server-supplied sequence range (see
-// expandRange). 2^24 entries is far beyond any legitimate mailbox while keeping
-// the worst-case expansion of a hostile range bounded.
+// Upper bound for expanding server-supplied sequence ranges (see expandRange). 2^24
+// entries in total is far beyond any legitimate mailbox while keeping the worst-case
+// expansion of a hostile range set bounded.
 const EXPANDED_RANGE_LIMIT = 0x1000000;
 
+// Digit bounds for untrusted numeric values in server responses. UIDs, UIDVALIDITY and
+// message counts are 32-bit unsigned (nz-number in the RFC 9051 grammar, so at most 10
+// digits); MODSEQ and number64 values are 63-bit unsigned (RFC 7162, RFC 9051), at most
+// 19 digits. The bound is checked before BigInt()/Number(): a response line may carry up
+// to maxLineLength digits, and BigInt() on a multi-megabyte digit run costs hundreds of
+// milliseconds of non-yielding CPU.
+const MAX_UINT32_DIGITS = 10;
+const MAX_NUMBER64_DIGITS = 19;
+
+// Object keys that reach through the prototype chain when assigned to, or resolve to an
+// inherited member when read. Server-controlled strings become keys in several places
+// (STATUS items, QUOTA resources, BODYSTRUCTURE parameters, FETCH body part names), so they
+// all consult this one set rather than each carrying its own list.
+const UNSAFE_OBJECT_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 // Extensions that RFC 9051 (IMAP4rev2) folds into the base protocol (Appendix E).
 // When IMAP4rev2 is active, these are available even without their own capability
 // token. BINARY is deliberately excluded - RFC 9051 only folds in the FETCH side,
@@ -252,7 +267,8 @@ const tools = {
 
         if (list && Array.isArray(list)) {
             list.forEach(val => {
-                if (typeof val.value !== 'string') {
+                // any entry can be a parsed NIL
+                if (!val || typeof val.value !== 'string') {
                     return;
                 }
                 let capability = val.value.toUpperCase().trim();
@@ -269,8 +285,7 @@ const tools = {
 
                 if (capability.startsWith('APPENDLIMIT=')) {
                     let splitPos = capability.indexOf('=');
-                    let appendLimit = Number(capability.substr(splitPos + 1)) || 0;
-                    map.set('APPENDLIMIT', appendLimit);
+                    map.set('APPENDLIMIT', tools.parseUintValue(capability.substr(splitPos + 1)) || 0);
                     return;
                 }
 
@@ -493,7 +508,9 @@ const tools = {
     async formatMessageResponse(untagged, mailbox) {
         let map = {};
 
-        map.seq = Number(untagged.command);
+        // The sequence number indexes into mailbox state, so an unusable one is dropped rather
+        // than coerced to NaN or Infinity
+        map.seq = tools.parseUintValue(untagged.command, MAX_UINT32_DIGITS) || undefined;
 
         let key;
         let attributes = (untagged.attributes && untagged.attributes[1]) || [];
@@ -538,15 +555,14 @@ const tools = {
                 }
             };
 
-            let getArray = attribute => {
-                if (Array.isArray(attribute)) {
-                    return attribute.map(entry => (entry && typeof entry.value === 'string' ? entry.value : false)).filter(entry => entry);
-                }
-                // NIL (parsed as null) and other non-array values yield an empty array,
-                // so callers can safely index into the result. RFC 8474 allows e.g.
-                // `THREADID NIL` when the server has no thread relation to report.
-                return [];
-            };
+            // NIL (parsed as null) and other non-array values yield an empty array, so callers
+            // can safely index into the result. RFC 8474 allows e.g. `THREADID NIL` when the
+            // server has no thread relation to report.
+            let getArray = attribute => tools.getStringList(attribute);
+
+            // Counts, sizes and UIDs are written into mailbox state and into range
+            // computations, so only a bounded decimal run is usable - see parseUintValue().
+            let getUint = (attribute, maxDigits) => tools.parseUintValue(getString(attribute), maxDigits);
 
             switch (key) {
                 case 'body[]':
@@ -555,7 +571,9 @@ const tools = {
                     break;
 
                 case 'uid':
-                    map.uid = Number(getString(attribute));
+                    // A UID feeds mailbox.uidNext one line below, and from there every range
+                    // computation, so an unusable one is dropped rather than coerced
+                    map.uid = getUint(attribute, MAX_UINT32_DIGITS) || undefined;
                     // If the UID we just saw is >= the mailbox's uidNext, bump uidNext.
                     // This keeps the local uidNext estimate current without requiring a
                     // separate STATUS command, handling cases where new messages arrived
@@ -565,14 +583,22 @@ const tools = {
                     }
                     break;
 
-                case 'modseq':
-                    map.modseq = BigInt(getArray(attribute)[0]);
+                case 'modseq': {
+                    // BigInt() throws on a non-numeric or missing value, and the throw
+                    // drops the whole message from the result set - so a malformed
+                    // MODSEQ from the server must be skipped, not surfaced.
+                    let modseq = tools.parseBigIntValue(getArray(attribute)[0]);
+                    if (modseq === false) {
+                        break;
+                    }
+                    map.modseq = modseq;
                     // Similarly, keep the local highestModseq estimate up to date.
                     // This is critical for CONDSTORE/QRESYNC delta syncing.
                     if (map.modseq && (!mailbox.highestModseq || mailbox.highestModseq < map.modseq)) {
                         mailbox.highestModseq = map.modseq;
                     }
                     break;
+                }
 
                 case 'emailid':
                     // OBJECTID extension (RFC 8474): server-assigned stable email identifier
@@ -599,7 +625,7 @@ const tools = {
                     break;
 
                 case 'rfc822.size':
-                    map.size = Number(getString(attribute)) || 0;
+                    map.size = getUint(attribute) || 0;
                     break;
 
                 case 'flags':
@@ -735,6 +761,11 @@ const tools = {
                 return []
                     .concat(list || [])
                     .map(addr => {
+                        if (!addr) {
+                            // A NIL entry inside an address list: skip it instead of
+                            // throwing on the dereference and dropping the message
+                            return false;
+                        }
                         let address = (getStrValue(addr[2]) || '') + '@' + (getStrValue(addr[3]) || '');
                         if (address === '@') {
                             address = '';
@@ -744,7 +775,7 @@ const tools = {
                             address
                         };
                     })
-                    .filter(addr => addr.name || addr.address);
+                    .filter(addr => addr && (addr.name || addr.address));
             },
             envelope = {};
 
@@ -813,7 +844,12 @@ const tools = {
         // BODYSTRUCTURE parameters come as flat key/value pairs: [key1, val1, key2, val2, ...]
         [].concat(arr || []).forEach((val, j) => {
             if (j % 2) {
-                params[key] = libmime.decodeWords(((val && val.value) || '').toString());
+                // Parameter names are server-controlled. The load-bearing check is the one in
+                // the continuation pass below, where the value is an object; here the value is
+                // always a string, which the __proto__ setter ignores anyway.
+                if (!tools.isUnsafeKey(key)) {
+                    params[key] = libmime.decodeWords(((val && val.value) || '').toString());
+                }
             } else {
                 key = ((val && val.value) || '').toString().toLowerCase();
             }
@@ -848,6 +884,14 @@ const tools = {
             actualKey = key.substr(0, match.index).toLowerCase();
             nr = Number(match[2]) || 0;
 
+            if (tools.isUnsafeKey(actualKey)) {
+                // A continuation key like "__proto__*0*" would group under "__proto__":
+                // params['__proto__'] resolves to Object.prototype, so the grouping
+                // writes below would mutate it (process-wide pollution). Drop the part.
+                delete params[key];
+                return;
+            }
+
             if (!params[actualKey] || typeof params[actualKey] !== 'object') {
                 params[actualKey] = {
                     charset: false,
@@ -1198,49 +1242,143 @@ const tools = {
         return Number.isSafeInteger(value) && value > 0 && value <= 0xffffffff;
     },
 
+    /**
+     * Checks that an untrusted response value is a pure decimal digit run no longer than
+     * the given bound.
+     *
+     * `!isNaN(value)` is not usable for this: it also passes '1e5', ' 12 ', '0x10' and
+     * 'Infinity'. BigInt() throws on all of them and Number() silently returns a value the
+     * grammar never allowed, so both are wrong in a response handler that is only trying to
+     * read one field. The length bound is checked before the pattern so an arbitrarily long
+     * digit run is rejected without any conversion work.
+     *
+     * @param {*} value - Raw value from the response.
+     * @param {Number} maxDigits - Maximum number of digits accepted.
+     * @returns {Boolean} True if the value is a decimal string within the bound.
+     */
+    isDecimalString(value, maxDigits) {
+        return typeof value === 'string' && value.length > 0 && value.length <= maxDigits && /^[0-9]+$/.test(value);
+    },
+
+    /**
+     * Checks whether a server-supplied string is unsafe to use as a key on a plain object.
+     * Assigning "__proto__" writes through the prototype setter instead of creating an own
+     * property, and reading "constructor" or "prototype" resolves to an inherited member.
+     *
+     * @param {*} key - Candidate key from a server response.
+     * @returns {Boolean} True if the key must not be used.
+     */
+    isUnsafeKey(key) {
+        return UNSAFE_OBJECT_KEYS.has(key);
+    },
+
+    /**
+     * Reads a parsed attribute list of atoms or strings (a flag list, a capability list) into
+     * an array of strings. Any element can be a parsed NIL, and the list itself can be NIL,
+     * so both levels are guarded here rather than at each call site.
+     *
+     * @param {*} list - Parsed attribute list from a response.
+     * @returns {String[]} The string values, in order, with unusable entries dropped.
+     */
+    getStringList(list) {
+        if (!Array.isArray(list)) {
+            return [];
+        }
+        return list.map(entry => (entry && typeof entry.value === 'string' ? entry.value : false)).filter(entry => entry);
+    },
+
+    /**
+     * Parses an untrusted decimal value from a server response into a BigInt.
+     *
+     * @param {*} value - Raw value from the response.
+     * @param {Number} [maxDigits=MAX_NUMBER64_DIGITS] - Maximum number of digits accepted.
+     * @returns {BigInt|false} The parsed value, or false when it is not usable.
+     */
+    parseBigIntValue(value, maxDigits) {
+        if (!tools.isDecimalString(value, maxDigits || MAX_NUMBER64_DIGITS)) {
+            return false;
+        }
+        return BigInt(value);
+    },
+
+    /**
+     * Parses an untrusted decimal value from a server response into a Number. Values beyond
+     * the safe integer range are rejected rather than rounded: a silently rounded count or
+     * UID corrupts every range computation derived from it.
+     *
+     * @param {*} value - Raw value from the response.
+     * @param {Number} [maxDigits=MAX_NUMBER64_DIGITS] - Maximum number of digits accepted.
+     * @returns {Number|false} The parsed value, or false when it is not usable.
+     */
+    parseUintValue(value, maxDigits) {
+        if (!tools.isDecimalString(value, maxDigits || MAX_NUMBER64_DIGITS)) {
+            return false;
+        }
+        let num = Number(value);
+        return Number.isSafeInteger(num) ? num : false;
+    },
+
     /**
      * Expands an IMAP sequence range string (e.g. "1:3,5,7:9") into an array of numbers.
      *
      * Entries with endpoints that are not valid nz-numbers are skipped - the input
      * may come from an untrusted server, and 'Infinity' or similar garbage would
-     * otherwise loop without bound. A single range is expanded to at most
-     * EXPANDED_RANGE_LIMIT entries: legitimate responses never reach the limit
-     * (the mailbox would need that many messages), while a hostile range like
-     * 1:4294967295 is cut off instead of exhausting memory.
+     * otherwise loop without bound. The whole set is expanded to at most
+     * EXPANDED_RANGE_LIMIT entries in total: legitimate responses never reach the limit
+     * (the mailbox would need that many messages), while hostile input is cut off
+     * instead of exhausting memory. The total is capped, not just each range -
+     * otherwise "1:16777216,1:16777216,..." would multiply the per-range bound by an
+     * unbounded number of ranges.
      *
      * @param {String} range - IMAP sequence range string
      * @returns {Number[]} Array of expanded sequence numbers
      */
     expandRange(range) {
-        return range.split(',').flatMap(entry => {
+        let result = [];
+        // Callers pass whatever the response parser produced for the sequence set, and a
+        // malformed response can leave that as `false` (e.g. a VANISHED response carrying
+        // only the (EARLIER) tag). Nothing to expand then, and throwing here would abort
+        // the handler for the rest of the response.
+        if (typeof range !== 'string') {
+            return result;
+        }
+        for (let entry of range.split(',')) {
+            if (result.length >= EXPANDED_RANGE_LIMIT) {
+                break;
+            }
             entry = entry.trim();
             let colon = entry.indexOf(':');
             if (colon < 0) {
                 let value = Number(entry);
-                return tools.isValidSequenceValue(value) ? value : [];
+                if (tools.isValidSequenceValue(value)) {
+                    result.push(value);
+                }
+                continue;
             }
             let first = Number(entry.substr(0, colon));
             let second = Number(entry.substr(colon + 1));
             if (!tools.isValidSequenceValue(first) || !tools.isValidSequenceValue(second)) {
-                return [];
+                continue;
             }
             if (first === second) {
-                return first;
+                result.push(first);
+                continue;
             }
-            let list = [];
+            // Remaining total budget doubles as the per-range bound
+            let remaining = EXPANDED_RANGE_LIMIT - result.length;
             if (first < second) {
-                let last = Math.min(second, first + EXPANDED_RANGE_LIMIT - 1);
+                let last = Math.min(second, first + remaining - 1);
                 for (let i = first; i <= last; i++) {
-                    list.push(i);
+                    result.push(i);
                 }
             } else {
-                let last = Math.max(second, first - EXPANDED_RANGE_LIMIT + 1);
+                let last = Math.max(second, first - remaining + 1);
                 for (let i = first; i >= last; i--) {
-                    list.push(i);
+                    result.push(i);
                 }
             }
-            return list;
-        });
+        }
+        return result;
     },
 
     /**
@@ -1248,13 +1386,17 @@ const tools = {
      * charset decoder for JIS/ISO-2022-JP, otherwise delegates to iconv-lite.
      *
      * @param {String} [charset='ascii'] - Character set name
+     * @param {Number} [maxBytes] - Bound for the bytes the decoder may buffer. Only
+     *   relevant for the Japanese decoder, which must buffer its whole input before
+     *   it can decode: without the bound a server could defeat a caller's maxBytes
+     *   download limit simply by labelling the part with a Japanese charset.
      * @returns {Object} A stream decoder (Transform stream) for the charset
      */
-    getDecoder(charset) {
+    getDecoder(charset, maxBytes) {
         charset = (charset || 'ascii').toString().trim().toLowerCase();
         if (/^jis|^iso-?2022-?jp|^euc-?jp/.test(charset)) {
             // special case not supported by iconv-lite
-            return new JPDecoder(charset);
+            return new JPDecoder(charset, maxBytes);
         }
 
         return iconv.decodeStream(charset);
@@ -1302,3 +1444,12 @@ const tools = {
 };
 
 module.exports = tools;
+
+// Shared bound for expanding server-supplied sequence sets (see expandRange). Exported so
+// other places that expand server sequences (e.g. ESEARCH ALL in commands/search.js) can
+// apply the same absolute ceiling instead of inventing their own.
+module.exports.EXPANDED_RANGE_LIMIT = EXPANDED_RANGE_LIMIT;
+
+// Exported so call sites can ask for the tighter 32-bit bound where the grammar requires it
+// (UID, UIDVALIDITY, message counts) instead of the parsers' 63-bit default.
+module.exports.MAX_UINT32_DIGITS = MAX_UINT32_DIGITS;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.6.5",
+    "version": "1.6.6",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",
@@ -35,7 +35,7 @@
         "eslint": "10.8.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "grunt": "1.6.2",
+        "grunt": "1.6.3",
         "grunt-cli": "1.5.0",
         "grunt-contrib-nodeunit": "5.0.0",
         "grunt-eslint": "26.0.0",
@@ -44,11 +44,11 @@
         "typescript": "7.0.2"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.14",
+        "@zone-eu/mailsplit": "5.4.15",
         "encoding-japanese": "2.2.0",
         "iconv-lite": "0.7.3",
         "libbase64": "1.3.0",
-        "libmime": "5.4.1",
+        "libmime": "5.4.2",
         "libqp": "2.1.1",
         "pino": "10.3.1",
         "socks": "2.8.9"

package/test/commands-branches-test.js

@@ -56,6 +56,10 @@ const createMockConnection = (overrides = {}) => {
         // A live transport: command implementations that guard against polling or writing on a
         // dead connection (idle.js) need this to look established.
         socket: overrides.socket || { destroyed: false },
+        // Mirrors ImapFlow.throttleWait(): resolves false on normal expiry, true when close()
+        // aborted the wait. The mock resolves immediately so throttle retries stay fast.
+        throttleWait: overrides.throttleWait || (async () => false),
+        createNoConnectionError: overrides.createNoConnectionError || (() => Object.assign(new Error('Connection not available'), { code: 'NoConnection' })),
         messageFlagsAdd: overrides.messageFlagsAdd || (async () => {}),
         messageCopy: overrides.messageCopy || (async () => {}),
         messageDelete: overrides.messageDelete || (async () => {}),