imapflow 1.6.5 → 1.7.0

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.6.5"
+    ".": "1.7.0"
 }

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [1.7.0](https://github.com/postalsys/imapflow/compare/v1.6.6...v1.7.0) (2026-08-11)
+
+
+### Features
+
+* **idle:** make the auto-IDLE delay configurable ([311fe0c](https://github.com/postalsys/imapflow/commit/311fe0ccb0d75d4ddbe797bf5bc755df5bf0485f))
+
+
+### Bug Fixes
+
+* **idle:** align the socket watchdog with the auto-IDLE busy guard ([d5e7191](https://github.com/postalsys/imapflow/commit/d5e71915ac7a1829b7e1340da6195a5e3e9984b2))
+* **idle:** validate autoIdleDelay and keep auto-IDLE off a busy connection ([aeafdf6](https://github.com/postalsys/imapflow/commit/aeafdf62fab3b29cd488d9b8cbdffc8896107d6e))
+
+## [1.6.6](https://github.com/postalsys/imapflow/compare/v1.6.5...v1.6.6) (2026-08-07)
+
+
+### Bug Fixes
+
+* harden parsing of untrusted server response values ([1560424](https://github.com/postalsys/imapflow/commit/15604240b5fe5f7ec57514db17f41123140b53fe))
+
 ## [1.6.5](https://github.com/postalsys/imapflow/compare/v1.6.4...v1.6.5) (2026-07-29)
 
 

package/lib/commands/append.js

@@ -1,6 +1,17 @@
 'use strict';
 
-const { formatFlag, canUseFlag, formatDateTime, normalizePath, encodePath, comparePaths, enhanceCommandError } = require('../tools.js');
+const {
+    formatFlag,
+    canUseFlag,
+    formatDateTime,
+    normalizePath,
+    encodePath,
+    comparePaths,
+    enhanceCommandError,
+    parseBigIntValue,
+    parseUintValue,
+    MAX_UINT32_DIGITS
+} = require('../tools.js');
 
 /**
  * Appends a message to a mailbox.
@@ -79,7 +90,15 @@ module.exports = async (connection, destination, content, flags, idate) => {
     // Handler for untagged EXISTS: captures the new message count which gives
     // us the sequence number of the appended message (it's the latest message).
     const handleExistsUpdate = untagged => {
-        map.seq = Number(untagged.command);
+        // The count is written into the live mailbox state below, so it has to clear the
+        // same bar untaggedExists() applies: a digit run long enough to coerce to Infinity
+        // would make resolveRange('*') compile to the literal string "Infinity" and break
+        // every range-based command until the next SELECT.
+        let seq = parseUintValue(untagged.command, MAX_UINT32_DIGITS);
+        if (seq === false) {
+            return;
+        }
+        map.seq = seq;
 
         // Update the connection's mailbox state and emit 'exists' event if the
         // count changed (notifies listeners about the new message).
@@ -109,8 +128,11 @@ module.exports = async (connection, destination, content, flags, idate) => {
         if (section && section.length) {
             let responseCode = section[0] && typeof section[0].value === 'string' ? section[0].value : '';
             if (responseCode.toUpperCase() === 'APPENDUID') {
-                let uidValidity = section[1] && typeof section[1].value === 'string' && !isNaN(section[1].value) ? BigInt(section[1].value) : false;
-                let uid = section[2] && typeof section[2].value === 'string' && !isNaN(section[2].value) ? Number(section[2].value) : false;
+                // Bounded digit runs only: isNaN() also passes '1e5', which BigInt() rejects
+                // with a throw - and this catch rethrows, so the append would reject after the
+                // message was already stored and a retrying caller would duplicate it.
+                let uidValidity = parseBigIntValue(section[1] && section[1].value, MAX_UINT32_DIGITS);
+                let uid = parseUintValue(section[2] && section[2].value, MAX_UINT32_DIGITS);
                 if (uidValidity !== false) {
                     map.uidValidity = uidValidity;
                 }

package/lib/commands/copyuid-parser.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { expandRange } = require('../tools.js');
+const { expandRange, parseBigIntValue } = require('../tools.js');
 
 /**
  * Parses COPYUID response code from an IMAP response (RFC 4315).
@@ -18,7 +18,9 @@ function parseCopyUid(response, map) {
         return;
     }
 
-    let uidValidity = section[1] && typeof section[1].value === 'string' && !isNaN(section[1].value) ? BigInt(section[1].value) : false;
+    // Only a bounded pure digit string is accepted: isNaN() also passes values like "1e5" or
+    // "Infinity", which BigInt() then rejects with a throw that loses the uidMap.
+    let uidValidity = parseBigIntValue(section[1] && section[1].value);
     if (uidValidity !== false) {
         map.uidValidity = uidValidity;
     }

package/lib/commands/expunge.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { enhanceCommandError, hasCapability } = require('../tools.js');
+const { enhanceCommandError, hasCapability, parseBigIntValue } = require('../tools.js');
 
 /**
  * Deletes specified messages by flagging them as Deleted and expunging.
@@ -41,7 +41,10 @@ module.exports = async (connection, range, options) => {
         let section = response.response.attributes && response.response.attributes[0] && response.response.attributes[0].section;
         let responseCode = section && section.length && section[0] && typeof section[0].value === 'string' ? section[0].value : '';
         if (responseCode.toUpperCase() === 'HIGHESTMODSEQ') {
-            let highestModseq = section[1] && typeof section[1].value === 'string' && !isNaN(section[1].value) ? BigInt(section[1].value) : false;
+            // Bounded digit runs only: isNaN() also passes '1e5', which BigInt() rejects with
+            // a throw that the catch below would swallow, making messageDelete() report false
+            // even though the server expunged the messages.
+            let highestModseq = parseBigIntValue(section[1] && section[1].value);
             if (highestModseq && (!connection.mailbox.highestModseq || highestModseq > connection.mailbox.highestModseq)) {
                 connection.mailbox.highestModseq = highestModseq;
             }

package/lib/commands/fetch.js

@@ -235,7 +235,9 @@ module.exports = async (connection, range, query, options) => {
                 // If server provides a throttleReset hint, use that if longer.
                 const backoffDelay = Math.min(baseDelay * Math.pow(2, retryCount), 30000); // Cap at 30 seconds
 
-                // Use throttle reset time if provided and longer than backoff
+                // Use throttle reset time if provided and longer than backoff. The hint is
+                // server-controlled, so the wait goes through connection.throttleWait(), which caps
+                // it and keeps the timer tracked and abortable.
                 const delay = err.throttleReset && err.throttleReset > backoffDelay ? err.throttleReset : backoffDelay;
 
                 connection.log.warn({
@@ -248,8 +250,12 @@ module.exports = async (connection, range, query, options) => {
                     delayMs: delay
                 });
 
-                // Wait before retrying
-                await new Promise(resolve => setTimeout(resolve, delay));
+                // An aborted wait means the client was closed, so give up rather than reissuing
+                // the FETCH on a connection that is already gone.
+                let aborted = await connection.throttleWait(delay);
+                if (aborted) {
+                    throw connection.createNoConnectionError(connection.byeReason);
+                }
 
                 retryCount++;
                 continue;

package/lib/commands/idle.js

@@ -257,14 +257,16 @@ async function runPollingFallback(connection, maxIdleTime) {
 
                 pollOnce(connection, session)
                     .then(() => {
+                        // Stamped only after a poll actually completed: a failed poll must not
+                        // satisfy the resumed schedule below, or the next session would defer
+                        // its first poll a full interval past an attempt that checked nothing.
+                        connection._lastPollAt = Date.now();
                         // Cancellation is re-checked here: the session may have been broken while
                         // this poll was in flight, and an orphaned poller must not schedule again.
                         if (session.cancelled) {
                             return;
                         }
-                        session.timer = setTimeout(runPoll, interval);
-                        // Background polling must not keep the process alive
-                        unrefTimer(session.timer);
+                        scheduleNextPoll(interval);
                     })
                     .catch(err => {
                         connection.log.warn({ err, cid: connection.id });
@@ -272,9 +274,28 @@ async function runPollingFallback(connection, maxIdleTime) {
                     });
             };
 
+            function scheduleNextPoll(delay) {
+                session.timer = setTimeout(runPoll, delay);
+                // Background polling must not keep the process alive
+                unrefTimer(session.timer);
+            }
+
             connection.log.debug({ src: 'c', msg: `initiated NOOP loop`, cid: connection.id });
-            // Keep the immediate first poll
-            runPoll();
+
+            // Every auto-IDLE restart begins a fresh polling session, so an unconditional first
+            // poll would tie the poll rate to how often the caller runs commands rather than to
+            // `interval`: with a short autoIdleDelay, a command every few seconds turns into a
+            // poll every few seconds. The last poll timestamp lives on the connection, so a new
+            // session resumes the previous one's schedule instead of restarting it.
+            // Clamped at zero because a backward wall-clock step (NTP, VM resume) leaves the
+            // stamp in the future; however large the jump, the next poll must never be more
+            // than one full interval away.
+            let sinceLastPoll = Math.max(0, Date.now() - (connection._lastPollAt || 0));
+            if (sinceLastPoll >= interval) {
+                runPoll();
+            } else {
+                scheduleNextPoll(interval - sinceLastPoll);
+            }
         });
     } finally {
         session.cancelled = true;

package/lib/commands/list.js

@@ -1,6 +1,16 @@
 'use strict';
 
-const { decodePath, encodePath, normalizePath, enhanceCommandError, hasCapability, isRev2Active, buildStatusQueryAttributes } = require('../tools.js');
+const {
+    decodePath,
+    encodePath,
+    normalizePath,
+    enhanceCommandError,
+    hasCapability,
+    isRev2Active,
+    buildStatusQueryAttributes,
+    getStringList
+} = require('../tools.js');
+const { parseStatusList } = require('./status-fields.js');
 const { specialUse } = require('../special-use');
 
 /**
@@ -133,7 +143,9 @@ module.exports = async (connection, reference, mailbox, options) => {
         // User-provided hints map mailbox paths to special-use types (e.g., {sent: "Sent Items"}).
         // These override server-reported flags and name-based guesses. Converted to a
         // path-keyed lookup: { "Sent Items" => "\\Sent" }
-        let specialUseHints = {};
+        // Keyed by server-supplied mailbox paths further down, so a null prototype keeps a
+        // path like "constructor" from resolving to an inherited member on lookup
+        let specialUseHints = Object.create(null);
         if (options.specialUseHints && typeof options.specialUseHints === 'object') {
             for (let type of Object.keys(options.specialUseHints)) {
                 if (
@@ -170,7 +182,7 @@ module.exports = async (connection, reference, mailbox, options) => {
                             // Decode from modified UTF-7 wire format and normalize the path
                             path: normalizePath(connection, decodePath(connection, (untagged.attributes[2] && untagged.attributes[2].value) || '')),
                             pathAsListed: (untagged.attributes[2] && untagged.attributes[2].value) || '',
-                            flags: new Set(untagged.attributes[0].map(entry => entry.value)),
+                            flags: new Set(getStringList(untagged.attributes[0])),
                             delimiter: untagged.attributes[1] && untagged.attributes[1].value,
                             listed: true
                         };
@@ -236,41 +248,9 @@ module.exports = async (connection, reference, mailbox, options) => {
                             return;
                         }
 
-                        const STATUS_FIELD_MAP = {
-                            MESSAGES: { key: 'messages', parser: Number },
-                            RECENT: { key: 'recent', parser: Number },
-                            UIDNEXT: { key: 'uidNext', parser: Number },
-                            UIDVALIDITY: { key: 'uidValidity', parser: BigInt },
-                            UNSEEN: { key: 'unseen', parser: Number },
-                            HIGHESTMODSEQ: { key: 'highestModseq', parser: BigInt },
-                            // IMAP4rev2 additions (RFC 9051): mailbox size and \Deleted count
-                            SIZE: { key: 'size', parser: Number },
-                            DELETED: { key: 'deleted', parser: Number }
-                        };
-
-                        let key;
                         let map = { path: statusPath };
-
-                        statusList.forEach((entry, i) => {
-                            if (i % 2 === 0) {
-                                key = entry && typeof entry.value === 'string' ? entry.value : false;
-                                return;
-                            }
-                            if (!key || !entry || typeof entry.value !== 'string') {
-                                return;
-                            }
-
-                            const fieldConfig = STATUS_FIELD_MAP[key.toUpperCase()];
-                            if (!fieldConfig) {
-                                return;
-                            }
-
-                            const value = !isNaN(entry.value) ? fieldConfig.parser(entry.value) : false;
-                            if (value === false) {
-                                return;
-                            }
-
-                            map[fieldConfig.key] = value;
+                        parseStatusList(statusList, (key, value) => {
+                            map[key] = value;
                         });
 
                         statusMap.set(statusPath, map);
@@ -455,7 +435,7 @@ module.exports = async (connection, reference, mailbox, options) => {
                         let entry = {
                             path: normalizePath(connection, decodePath(connection, (untagged.attributes[2] && untagged.attributes[2].value) || '')),
                             pathAsListed: (untagged.attributes[2] && untagged.attributes[2].value) || '',
-                            flags: new Set(untagged.attributes[0].map(entry => entry.value)),
+                            flags: new Set(getStringList(untagged.attributes[0])),
                             delimiter: untagged.attributes[1] && untagged.attributes[1].value,
                             subscribed: true
                         };

package/lib/commands/namespace.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { hasCapability } = require('../tools.js');
+const { hasCapability, getStringList } = require('../tools.js');
 
 /**
  * Requests NAMESPACE info from the server.
@@ -95,7 +95,7 @@ async function getListPrefix(connection) {
                         return;
                     }
 
-                    map.flags = new Set(untagged.attributes[0].map(entry => entry.value));
+                    map.flags = new Set(getStringList(untagged.attributes[0]));
                     map.delimiter = untagged.attributes[1] && untagged.attributes[1].value;
                     map.prefix = (untagged.attributes[2] && untagged.attributes[2].value) || '';
                     if (map.delimiter && map.prefix.charAt(0) === map.delimiter) {

package/lib/commands/quota.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { encodePath, normalizePath, enhanceCommandError } = require('../tools.js');
+const { encodePath, normalizePath, enhanceCommandError, parseUintValue, isUnsafeKey } = require('../tools.js');
 
 /**
  * Requests quota information for a mailbox.
@@ -47,11 +47,19 @@ module.exports = async (connection, path) => {
                 return;
             }
 
-            let value = attribute && typeof attribute.value === 'string' && !isNaN(attribute.value) ? Number(attribute.value) : false;
+            // isNaN() also passes '1e5', ' 12 ' and 'Infinity', none of which is a usable octet count
+            let value = parseUintValue(attribute && attribute.value);
             if (value === false) {
                 return;
             }
 
+            // Resource names are server-controlled. This object is returned to the caller, so it
+            // keeps a normal prototype and unsafe names are dropped instead; the fixed fields
+            // must keep their values too.
+            if (isUnsafeKey(key) || key === 'path' || key === 'quotaroot') {
+                return;
+            }
+
             if (!map[key]) {
                 map[key] = {};
             }

package/lib/commands/search.js

@@ -1,6 +1,14 @@
 'use strict';
 
-const { enhanceCommandError, hasCapability, isValidSequenceValue } = require('../tools.js');
+const {
+    enhanceCommandError,
+    hasCapability,
+    isValidSequenceValue,
+    parseBigIntValue,
+    parseUintValue,
+    MAX_UINT32_DIGITS,
+    EXPANDED_RANGE_LIMIT
+} = require('../tools.js');
 const { searchCompiler } = require('../search-compiler.js');
 
 /**
@@ -48,27 +56,29 @@ function parseEsearchResponse(attrs) {
             continue;
         }
         switch (key) {
+            // COUNT is a plain message count; MIN and MAX are sequence numbers or UIDs. All
+            // three are bounded decimal runs - isNaN() would also admit '1e400' (Infinity)
             case 'COUNT': {
-                const n = Number(attrs[++i]?.value);
-                if (!isNaN(n)) result.count = n;
+                const n = parseUintValue(attrs[++i]?.value, MAX_UINT32_DIGITS);
+                if (n !== false) result.count = n;
                 break;
             }
             case 'MIN': {
-                const n = Number(attrs[++i]?.value);
-                if (!isNaN(n)) result.min = n;
+                const n = parseUintValue(attrs[++i]?.value, MAX_UINT32_DIGITS);
+                if (n !== false) result.min = n;
                 break;
             }
             case 'MAX': {
-                const n = Number(attrs[++i]?.value);
-                if (!isNaN(n)) result.max = n;
+                const n = parseUintValue(attrs[++i]?.value, MAX_UINT32_DIGITS);
+                if (n !== false) result.max = n;
                 break;
             }
             case 'MODSEQ': {
                 // RFC 7162 section 3.1.5: present when the SEARCH used a MODSEQ
                 // criterion on a CONDSTORE-enabled session. BigInt because
                 // mod-sequence values are unsigned 63-bit
-                const value = attrs[++i]?.value;
-                if (typeof value === 'string' && /^\d+$/.test(value)) result.modseq = BigInt(value);
+                const modseq = parseBigIntValue(attrs[++i]?.value);
+                if (modseq !== false) result.modseq = modseq;
                 break;
             }
             case 'ALL': {
@@ -192,11 +202,37 @@ module.exports = async (connection, query, options) => {
             untagged: {
                 SEARCH: async untagged => {
                     if (untagged && untagged.attributes && untagged.attributes.length) {
-                        untagged.attributes.forEach(attribute => {
-                            if (attribute && attribute.value && typeof attribute.value === 'string' && !isNaN(attribute.value)) {
-                                results.add(Number(attribute.value));
+                        let truncated = false;
+                        let discarded = false;
+                        for (let attribute of untagged.attributes) {
+                            // The result set is server-controlled and accumulated across
+                            // responses, so stop at the same absolute ceiling expandRange()
+                            // uses - a server streaming SEARCH responses could otherwise
+                            // grow the set until the process runs out of memory
+                            /* c8 ignore next 4 */ // reaching the ceiling needs 2^24 accumulated results, which no unit test can produce in reasonable time
+                            if (results.size >= EXPANDED_RANGE_LIMIT) {
+                                truncated = true;
+                                break;
                             }
-                        });
+                            // Same nz-number check the ESEARCH branch below applies. isNaN()
+                            // is not enough: it passes '1e400' (Infinity), '-3' and '2.5', and
+                            // a single one of those makes the sequence set compiled from this
+                            // result set invalid, failing the caller's whole follow-up command
+                            let value = attribute && typeof attribute.value === 'string' ? Number(attribute.value) : NaN;
+                            if (!isValidSequenceValue(value)) {
+                                discarded = true;
+                                continue;
+                            }
+                            results.add(value);
+                        }
+                        if (truncated || discarded) {
+                            connection.log.warn({
+                                msg: 'Invalid entries in the SEARCH result',
+                                truncated,
+                                discarded,
+                                cid: connection.id
+                            });
+                        }
                     }
                 },
 
@@ -222,7 +258,11 @@ module.exports = async (connection, query, options) => {
                         // not contain '*' at all (RFC 9051 section 4.1.1), so UID
                         // parts with '*' are dropped
                         let existsCount = () => (connection.mailbox && connection.mailbox.exists) || 0;
-                        let overBudget = () => results.size >= existsCount();
+                        // The mailbox EXISTS count is itself server-supplied and can be
+                        // absurdly large, so the budget is additionally capped at the same
+                        // absolute ceiling expandRange() uses - a hostile server cannot
+                        // bypass it by inflating EXISTS first
+                        let overBudget = () => results.size >= existsCount() || results.size >= EXPANDED_RANGE_LIMIT;
                         let resolveId = part => (part === '*' ? (options.uid ? 0 : existsCount()) : Number(part));
                         let truncated = false;
                         let discarded = false;