imapflow 1.6.5 → 1.7.0

package/test/connection-edge-cases-test.js

@@ -254,7 +254,9 @@ module.exports['Connection Edge: Socket timeout during IDLE'] = test => {
     // Give async operations time to complete
     setTimeout(() => {
         test.ok(noopCalled, 'NOOP should be called to recover from IDLE timeout');
-        test.ok(idleCalled, 'Should return to IDLE after NOOP');
+        // Returning to IDLE is autoidle()'s decision once the NOOP settles (run() re-arms it);
+        // the watchdog handler itself must not bypass the busy guard by calling idle() directly
+        test.equal(idleCalled, false, 'the timeout handler does not restart IDLE by itself');
         test.done();
     }, 100);
 };

package/test/copyuid-parser-test.js

@@ -151,3 +151,23 @@ module.exports['CopyUID Parser: uidValidity zero is stored as BigInt(0)'] = test
     test.equal(map.uidMap.get(1), 100);
     test.done();
 };
+
+// ============================================
+// Hostile server input
+// ============================================
+
+module.exports['CopyUID Parser: non-decimal uidValidity is ignored, uidMap still parsed'] = test => {
+    // isNaN() passed values like "1e5" and "Infinity" through, and BigInt() then threw,
+    // losing the whole COPYUID result
+    let map = {};
+    parseCopyUid(makeResponse([{ value: 'COPYUID' }, { value: '1e5' }, { value: '1' }, { value: '100' }]), map);
+    test.equal(map.uidValidity, undefined);
+    test.ok(map.uidMap instanceof Map);
+    test.equal(map.uidMap.get(1), 100);
+
+    let map2 = {};
+    parseCopyUid(makeResponse([{ value: 'COPYUID' }, { value: 'Infinity' }, { value: '1' }, { value: '100' }]), map2);
+    test.equal(map2.uidValidity, undefined);
+    test.equal(map2.uidMap.get(1), 100);
+    test.done();
+};

package/test/fixtures/test-client.js

@@ -0,0 +1,57 @@
+'use strict';
+
+// Shared ImapFlow construction for unit tests that poke at internals without a live server.
+// One definition instead of a per-file copy, so a change to what the constructor needs lands
+// in one place and cannot drift between suites.
+
+const { ImapFlow } = require('../../lib/imap-flow');
+
+// A socket stub complete enough for setSocketHandlers(), clearSocketHandlers() and close() to
+// run against. removeListener/removeAllListeners matter most: close() removes the handlers it
+// installed, and a stub without them makes close() throw half-way through teardown with the
+// client still holding its socket and streamer references.
+const makeSocketStub = () => ({
+    destroyed: false,
+    destroy: () => {},
+    on: () => {},
+    once: () => {},
+    end: () => {},
+    unpipe: () => {},
+    removeListener: () => {},
+    removeAllListeners: () => {},
+    setKeepAlive: () => {},
+    setTimeout: () => {}
+});
+
+// Bare construction: no socket, no state overrides. Tests that need a transport use
+// makeSocketStub() or makeIdleReadyClient() instead of reaching for their own object literals.
+const makeClient = (overrides = {}) =>
+    new ImapFlow({
+        host: '127.0.0.1',
+        port: 993,
+        logger: false,
+        auth: { user: 'test', pass: 'secret' },
+        ...overrides
+    });
+
+// A client parked in SELECTED with a stubbed socket and a no-op idle(), ready for autoidle(),
+// lock handling and watchdog behavior to be exercised directly
+const makeIdleReadyClient = (overrides = {}) => {
+    let client = makeClient({ maxLockHoldTime: 0, ...overrides });
+    client.socket = makeSocketStub();
+    client.usable = true;
+    client.state = client.states.SELECTED;
+    client.mailbox = { path: 'INBOX', readOnly: false };
+    client.idle = async () => {};
+    return client;
+};
+
+// A fetchOne stand-in that serves `body` back in download()'s chunk-query shape
+// ({source: {start, maxLength}}), so download tests do not each restate that contract
+const chunkedFetchOne = body => async (range, query) => {
+    let start = query.source.start;
+    let maxLength = query.source.maxLength;
+    return { uid: 1, size: body.length, source: body.subarray(start, start + maxLength) };
+};
+
+module.exports = { makeClient, makeIdleReadyClient, makeSocketStub, chunkedFetchOne };

package/test/idle-polling-test.js

@@ -428,3 +428,91 @@ module.exports['Polling: a break in the initiation tick prevents the first poll'
         test.done();
     });
 };
+
+module.exports['Polling: a restarted session resumes the schedule instead of polling again'] = async test => {
+    await withFakeTimers(async timers => {
+        let connection = createConnection();
+
+        let first = idleCommand(connection, 60000);
+        await timers.drain();
+        test.deepEqual(connection.commands, ['NOOP'], 'the first session polls immediately');
+
+        await connection.preCheck();
+        await first;
+
+        // Auto-IDLE restarts the loop after every caller command. An unconditional first poll here
+        // would tie the poll rate to how often the caller runs commands instead of to the poll
+        // interval - with a short autoIdleDelay, a command every few seconds means a poll every
+        // few seconds.
+        let second = idleCommand(connection, 60000);
+        await timers.drain();
+        test.deepEqual(connection.commands, ['NOOP'], 'the restarted session does not poll again');
+        test.equal(timers.count(), 1, 'it waits out the remainder of the interval instead');
+        test.ok(timers.pending()[0].delay <= 60000, 'and never longer than a full interval');
+
+        await connection.preCheck();
+        await second;
+
+        // Once a full interval has elapsed, a fresh session polls at once again
+        connection._lastPollAt = Date.now() - 61000;
+        let third = idleCommand(connection, 60000);
+        await timers.drain();
+        test.deepEqual(connection.commands, ['NOOP', 'NOOP'], 'a session starting after the interval polls right away');
+
+        await connection.preCheck();
+        await third;
+        test.done();
+    });
+};
+
+module.exports['Polling: a failed poll does not defer the next session'] = async test => {
+    await withFakeTimers(async timers => {
+        let failNext = true;
+        let connection = createConnection({
+            exec: async command => {
+                connection.commands.push(command);
+                if (failNext) {
+                    failNext = false;
+                    throw new Error('poll failed');
+                }
+                return { next: () => {} };
+            }
+        });
+
+        // The failing poll cancels its own session. The attempt checked nothing, so it must not
+        // count as a poll: only a completed poll moves the schedule stamp forward.
+        let first = idleCommand(connection, 60000);
+        await timers.drain();
+        await first;
+        test.deepEqual(connection.commands, ['NOOP'], 'the first poll ran and failed');
+
+        let second = idleCommand(connection, 60000);
+        await timers.drain();
+        test.deepEqual(connection.commands, ['NOOP', 'NOOP'], 'the next session retries immediately instead of waiting out an interval');
+
+        await connection.preCheck();
+        await second;
+        test.done();
+    });
+};
+
+module.exports['Polling: a backward clock step never defers the next poll past one interval'] = async test => {
+    await withFakeTimers(async timers => {
+        let connection = createConnection();
+
+        // A last-poll stamp in the future is what an NTP step or a VM clock sync leaves behind.
+        // Without the clamp the remainder math would schedule the next poll a full clock jump
+        // plus one interval away.
+        connection._lastPollAt = Date.now() + 60 * 60 * 1000;
+
+        let idlePromise = idleCommand(connection, 60000);
+        await timers.drain();
+        test.deepEqual(connection.commands, [], 'no immediate poll - the schedule is resumed');
+        test.equal(timers.count(), 1, 'a poll timer is armed');
+        test.ok(timers.pending()[0].delay <= 60000, 'and it is never more than one interval away');
+
+        await connection.preCheck();
+        await idlePromise;
+        test.done();
+    });
+};

package/test/imap-flow-coverage-test.js

@@ -5,6 +5,7 @@
 // reader/handler error branches.
 
 const { ImapFlow } = require('../lib/imap-flow');
+const { makeSocketStub } = require('./fixtures/test-client');
 
 const makeClient = (overrides = {}) => {
     let client = new ImapFlow({
@@ -293,15 +294,6 @@ module.exports['Coverage: authenticate throws when run yields falsy auth result'
 // Socket event handlers (built by setSocketHandlers)
 // ============================================================================
 
-// Minimal socket stub that records listeners so handlers can be invoked directly.
-const makeSocketStub = () => ({
-    destroyed: false,
-    once() {},
-    on() {},
-    removeListener() {},
-    destroy() {}
-});
-
 module.exports['Coverage: setSocketHandlers removes a lingering connect error handler'] = test => {
     let client = makeClient();
     let removed = null;
@@ -389,7 +381,9 @@ module.exports['Coverage: _socketTimeout recovers an IDLE connection with NOOP']
     await drain();
     await drain();
     test.ok(noopRun, 'NOOP issued to recover IDLE');
-    test.ok(idleResumed, 'IDLE resumed after NOOP');
+    // Restarting IDLE is autoidle()'s decision once the NOOP settles (run() re-arms it);
+    // the watchdog handler itself must not bypass the busy guard by calling idle() directly.
+    test.equal(idleResumed, false, 'the handler does not restart IDLE by itself');
     test.done();
 };
 
@@ -591,9 +585,11 @@ module.exports['Coverage: reader caps very large throttle backoff'] = async test
     let readerPromise = runReaderWith(client, ['A1 BAD Request is throttled. Suggested Backoff Time: 999999999 milliseconds']);
     // give the reader a tick to register the throttle timer, then abort it
     await drain();
-    if (typeof client._throttleAbort === 'function') {
-        client._throttleAbort(true);
+    for (let entry of client._throttleWaits) {
+        clearTimeout(entry.timer);
+        entry.resolve(true);
     }
+    client._throttleWaits.clear();
     await readerPromise;
     test.ok(rejected);
     test.done();

package/test/imap-flow-fetch-download-test.js

@@ -9,6 +9,7 @@ const libbase64 = require('libbase64');
 const libqp = require('libqp');
 const libmime = require('libmime');
 const { Writable, finished } = require('stream');
+const { chunkedFetchOne } = require('./fixtures/test-client');
 
 const makeClient = (overrides = {}) => {
     let client = new ImapFlow({
@@ -217,11 +218,7 @@ module.exports['Download: returns empty object without mailbox'] = async test =>
 module.exports['Download: full message in multiple chunks'] = async test => {
     let client = makeClient();
     let body = Buffer.from('A'.repeat(10));
-    client.fetchOne = async (range, query) => {
-        let start = query.source.start;
-        let maxLength = query.source.maxLength;
-        return { uid: 1, size: body.length, source: body.slice(start, start + maxLength) };
-    };
+    client.fetchOne = chunkedFetchOne(body);
     let { meta, content } = await client.download('1', false, { chunkSize: 4 });
     test.equal(meta.contentType, 'message/rfc822');
     test.equal(meta.expectedSize, 10);
@@ -233,11 +230,7 @@ module.exports['Download: full message in multiple chunks'] = async test => {
 module.exports['Download: falls back to default chunkSize/maxBytes when zero'] = async test => {
     let client = makeClient();
     let body = Buffer.from('tiny');
-    client.fetchOne = async (range, query) => {
-        let start = query.source.start;
-        let maxLength = query.source.maxLength;
-        return { uid: 1, size: body.length, source: body.slice(start, start + maxLength) };
-    };
+    client.fetchOne = chunkedFetchOne(body);
     // zero values are falsy -> the (|| default) fallbacks kick in
     let { content } = await client.download('1', false, { chunkSize: 0, maxBytes: 0 });
     let data = await collect(content);
@@ -852,3 +845,29 @@ module.exports['DownloadMany: decodes base64 and quoted-printable parts'] = asyn
     test.equal(res['3'].meta.disposition, 'attachment');
     test.done();
 };
+
+module.exports['Download: a buffering transform cannot defeat maxBytes'] = async test => {
+    // format=flowed unwrapping and the Japanese charset decoder both hold their whole input
+    // before emitting anything, so the limiter at the tail of the pipeline reports
+    // `limited === false` however much the server sends. Without a bound of their own the fetch
+    // loop would keep pulling the entire part.
+    for (let contentType of ['text/plain; format=flowed', 'text/plain; charset=iso-2022-jp']) {
+        let client = makeClient();
+        let mime = Buffer.from(`Content-Type: ${contentType}\r\nContent-Disposition: inline\r\n\r\n`);
+        let calls = 0;
+        client.fetchOne = async () => {
+            calls++;
+            let bodyParts = new Map();
+            bodyParts.set('2.mime', mime);
+            // full-size chunks keep hasMore true; the loop must stop on its own, not run dry
+            bodyParts.set('2', calls <= 40 ? Buffer.alloc(1024, 0x61) : Buffer.alloc(1));
+            return { uid: 1, size: 1024 * 1024, bodyParts };
+        };
+
+        let { content } = await client.download('1', '2', { chunkSize: 1024, maxBytes: 512 });
+        let data = await collect(content);
+        test.ok(data.length <= 512, `${contentType}: delivered ${data.length} bytes, expected no more than 512`);
+        test.ok(calls <= 3, `${contentType}: the fetch loop must stop at the bound, made ${calls} calls`);
+    }
+    test.done();
+};

package/test/imap-flow-internals-test.js

@@ -6,17 +6,8 @@
 // and the untaggedFetch flag/modseq branches.
 
 const { ImapFlow } = require('../lib/imap-flow');
-
-const makeClient = (overrides = {}) => {
-    let client = new ImapFlow({
-        host: 'imap.example.com',
-        port: 993,
-        auth: { user: 'test', pass: 'test' },
-        logger: false,
-        ...overrides
-    });
-    return client;
-};
+const { withFakeTimers } = require('./fixtures/fake-timers');
+const { makeClient, makeIdleReadyClient } = require('./fixtures/test-client');
 
 // ============================================================================
 // emitError
@@ -275,29 +266,20 @@ module.exports['Internals: autoidle does nothing when not selected'] = test => {
     test.done();
 };
 
-module.exports['Internals: autoidle schedules idle when selected'] = test => {
-    let client = makeClient();
-    client.state = client.states.SELECTED;
+module.exports['Internals: autoidle schedules idle when selected'] = async test => {
+    await withFakeTimers(async timers => {
+        let client = makeIdleReadyClient();
+
+        let idleCalled = false;
+        client.idle = async () => {
+            idleCalled = true;
+        };
 
-    let realSetTimeout = global.setTimeout;
-    let idleCalled = false;
-    client.idle = async () => {
-        idleCalled = true;
-    };
-    // Intercept the 15s idle timer and fire it synchronously
-    global.setTimeout = (fn, ms) => {
-        if (ms === 15 * 1000) {
-            fn();
-            return { unref() {} };
-        }
-        return realSetTimeout(fn, ms);
-    };
-    try {
         client.autoidle();
-    } finally {
-        global.setTimeout = realSetTimeout;
-    }
-    test.ok(idleCalled);
+        await timers.fire();
+
+        test.ok(idleCalled);
+    });
     test.done();
 };
 

package/test/imap-flow-methods-test.js

@@ -795,3 +795,95 @@ module.exports['Methods: autoEnable does not retry when disableIMAP4rev2 already
     test.equal(calls.length, 1);
     test.done();
 };
+
+module.exports['Methods: untaggedExpunge refuses an unusable sequence number'] = async test => {
+    // Same bound untaggedExists() applies: an overflowing or non-decimal value must not
+    // decrement the live message count
+    let client = makeClient();
+    client.mailbox.exists = 10;
+    let events = [];
+    client.on('expunge', e => events.push(e));
+
+    await client.untaggedExpunge(false);
+    for (let bad of ['9'.repeat(400), '1e5', '0', 'abc', '']) {
+        await client.untaggedExpunge({ command: bad });
+    }
+    test.equal(client.mailbox.exists, 10, 'the live message count must be left alone');
+    test.equal(events.length, 0);
+
+    await client.untaggedExpunge({ command: '3' });
+    test.equal(client.mailbox.exists, 9, 'a usable sequence number is still applied');
+    test.equal(events.length, 1);
+    test.equal(events[0].seq, 3);
+    test.done();
+};
+
+module.exports['Methods: untaggedVanished survives a malformed response'] = async test => {
+    // "* VANISHED (EARLIER)" leaves no sequence set at all. Throwing here would abort the
+    // handler for the whole response, and handleResponse only warns - so every expunge the
+    // response did carry would be dropped and the client's mailbox view would go stale.
+    let client = makeClient();
+    let events = [];
+    client.on('expunge', e => events.push(e));
+
+    await client.untaggedVanished({ attributes: [[{ value: 'EARLIER' }]] });
+    await client.untaggedVanished({ attributes: [] });
+    await client.untaggedVanished({});
+    await client.untaggedVanished({ attributes: [[{ value: 'EARLIER' }], null] });
+
+    test.equal(events.length, 0, 'nothing to report, and nothing thrown');
+
+    // a well-formed response still works after the malformed ones
+    await client.untaggedVanished({ attributes: [[{ value: 'EARLIER' }], { value: '5:6' }] });
+    test.equal(events.length, 2);
+    test.equal(events[0].uid, 5);
+    test.equal(events[0].earlier, true);
+    test.done();
+};
+
+module.exports['Methods: untaggedExists refuses an overflowing count'] = async test => {
+    // Number('9'.repeat(400)) is Infinity: resolveRange('*') would then compile the literal
+    // string "Infinity" and every range-based command would fail until the next SELECT
+    let client = makeClient();
+    client.mailbox = { path: 'INBOX', exists: 5 };
+    let events = [];
+    client.on('exists', e => events.push(e));
+
+    await client.untaggedExists(false);
+    await client.untaggedExists({});
+    for (let bad of ['9'.repeat(400), '1e5', '-1', 'abc', '1.5', '']) {
+        await client.untaggedExists({ command: bad });
+    }
+    test.equal(client.mailbox.exists, 5, 'the live message count must be left alone');
+    test.equal(events.length, 0);
+
+    await client.untaggedExists({ command: '7' });
+    test.equal(client.mailbox.exists, 7, 'a usable count is still applied');
+    test.equal(events.length, 1);
+    test.done();
+};
+
+module.exports['Methods: throttleWait caps the delay and close() aborts it'] = async test => {
+    let client = makeClient();
+
+    // A server hint is unbounded; the wait may never outlive the client either
+    let started = Date.now();
+    let pending = client.throttleWait(7 * 24 * 3600 * 1000);
+    test.equal(client._throttleWaits.size, 1, 'the wait is tracked so close() can reach it');
+
+    client.close();
+    test.equal(await pending, true, 'an aborted wait reports true');
+    test.equal(client._throttleWaits.size, 0, 'the tracked wait is released');
+    test.ok(Date.now() - started < 5000, 'close() must not wait out the delay');
+
+    // normal expiry reports false and releases the entry. The back-off timer is deliberately
+    // unref'd, so the test has to hold the event loop open itself - in a real session the
+    // socket does that.
+    let client2 = makeClient();
+    let keepAlive = setTimeout(() => {}, 1000);
+    test.equal(await client2.throttleWait(1), false);
+    clearTimeout(keepAlive);
+    test.equal(client2._throttleWaits.size, 0);
+    client2.close();
+    test.done();
+};

package/test/imap-stream-edge-cases-test.js

@@ -528,3 +528,139 @@ module.exports['Literal marker still accepts sizes at the digit-length bound'] =
     test.equal(ok.literalWaiting, 1024);
     test.done();
 };
+
+module.exports['Response assembly enforces the cumulative size cap'] = test => {
+    // The per-line and per-literal caps alone cannot stop a response spread across many
+    // tokens: under a 40-byte response budget, a 25-byte marker line plus a declared
+    // 10-byte literal fits (35), but the next marker line (16 bytes + 10 declared) must
+    // trip the cap - before the second literal's bytes are even read
+    const stream = new ImapStream({ cid: 'test', maxResponseSize: 40 });
+    let streamErr = null;
+    stream.on('error', err => {
+        streamErr = err;
+    });
+    stream.resume();
+
+    stream.write(Buffer.from('* 1 FETCH (BODY[1] {10}\r\n'));
+    stream.write(Buffer.from('0123456789'));
+    stream.write(Buffer.from(' BODY[2] {10}\r\n0123456789)\r\n'));
+
+    setTimeout(() => {
+        test.ok(streamErr, 'an oversized cumulative response must fail the stream');
+        test.equal(streamErr && streamErr.code, 'ResponseTooLarge');
+        test.ok(stream.destroyed, 'the stream must fail closed instead of parsing the rejected payload');
+        test.done();
+    }, 100);
+};
+
+// Resolves once the stream has settled - on its first 'error', or on 'end' when it is
+// consumed to completion. Waiting for the real signal keeps these tests off fixed sleeps.
+const settle = stream =>
+    new Promise(resolve => {
+        stream.once('error', err => resolve(err));
+        stream.once('end', () => resolve(null));
+    });
+
+module.exports['Response size budget resets between responses'] = async test => {
+    // The counter tracks a single response, not the whole session. Each response here fits
+    // the 40-byte budget on its own but the two together do not, so a counter that failed to
+    // reset would trip the cap on the second one - which is what makes this test detect the
+    // regression rather than merely pass alongside it.
+    const line = '* OK ' + 'a'.repeat(23) + '\r\n'; // 30 bytes, two of them exceed the budget
+    const stream = new ImapStream({ cid: 'test', maxResponseSize: 40 });
+    let streamErr = null;
+    let count = 0;
+    stream.on('error', err => {
+        streamErr = err;
+    });
+    stream.on('data', cmd => {
+        count++;
+        cmd.next();
+    });
+
+    test.ok(line.length <= 40 && line.length * 2 > 40, 'each response fits the budget, the pair does not');
+
+    stream.write(Buffer.from(line + line));
+    stream.end();
+
+    await settle(stream);
+    test.ifError(streamErr);
+    test.equal(count, 2);
+    test.done();
+};
+
+module.exports['Response size cap defaults above the literal cap'] = test => {
+    // The response total also carries the literal marker line and the rest of the framing, so
+    // a default equal to the literal cap would make a literal of exactly the maximum permitted
+    // size impossible to receive
+    const stream = new ImapStream({ cid: 'test' });
+    test.equal(stream.maxResponseSize, 2 * 1024 * 1024 * 1024);
+    test.ok(stream.maxResponseSize > stream.maxLiteralSize, 'the response cap must leave headroom above the literal cap');
+    test.done();
+};
+
+module.exports['A literal of exactly maxLiteralSize is accepted when the response cap leaves headroom'] = async test => {
+    const stream = new ImapStream({ cid: 'test', maxLiteralSize: 100, maxResponseSize: 200 });
+    let streamErr = null;
+    let received = null;
+    stream.on('error', err => {
+        streamErr = err;
+    });
+    stream.on('data', cmd => {
+        received = cmd;
+        cmd.next();
+    });
+
+    stream.write(Buffer.from('* 1 FETCH (BODY[] {100}\r\n'));
+    stream.write(Buffer.from('x'.repeat(100)));
+    stream.write(Buffer.from(')\r\n'));
+    stream.end();
+
+    await settle(stream);
+    test.ifError(streamErr);
+    test.ok(received, 'a literal at exactly the configured maximum must be delivered');
+    test.equal(received.literals.length, 1);
+    test.equal(received.literals[0].length, 100);
+    test.done();
+};
+
+module.exports['An unterminated line is bounded by the response budget'] = async test => {
+    // maxResponseSize is only committed when a line completes, so an in-progress line has to
+    // be measured against the remaining budget separately - otherwise a response cap lowered
+    // to bound parser memory buys nothing while a server streams a line that never ends
+    const stream = new ImapStream({ cid: 'test', maxResponseSize: 64 });
+    stream.resume();
+
+    stream.write(Buffer.from('x'.repeat(1024))); // no line terminator anywhere
+
+    let err = await settle(stream);
+    test.ok(err, 'an unterminated line beyond the response budget must fail the stream');
+    test.equal(err.code, 'ResponseTooLarge');
+    test.ok(stream.lineBytes <= 64, 'no more than the budget may stay buffered');
+    test.done();
+};
+
+module.exports['Infinity disables a parser size cap'] = test => {
+    // A cap that cannot be disabled forces a caller who knows their server onto the default
+    const stream = new ImapStream({ cid: 'test', maxResponseSize: Infinity, maxLiteralSize: Infinity, maxLineLength: Infinity });
+    test.equal(stream.maxResponseSize, Infinity);
+    test.equal(stream.maxLiteralSize, Infinity);
+    test.equal(stream.maxLineLength, Infinity);
+    test.done();
+};
+
+module.exports['A marker line that fits the budget can still be refused for its literal'] = async test => {
+    // The line is measured against the budget as it is assembled, but the declared literal is
+    // only charged once the marker line completes - so the cap has to be enforced in both places
+    const stream = new ImapStream({ cid: 'test', maxResponseSize: 40 });
+    stream.resume();
+
+    // 25-byte marker line fits on its own; the 30 declared literal bytes push the total past 40
+    stream.write(Buffer.from('* 1 FETCH (BODY[1] {30}\r\n'));
+
+    let err = await settle(stream);
+    test.ok(err, 'the declared literal must be charged before its bytes arrive');
+    test.equal(err.code, 'ResponseTooLarge');
+    test.equal(err.responseSize, 55);
+    test.done();
+};

package/test/jp-decoder-test.js

@@ -245,3 +245,60 @@ module.exports['JPDecoder: handles EUC-JP charset'] = async test => {
     test.ok(result.length > 0);
     test.done();
 };
+
+// ============================================
+// maxBytes buffering bound
+// ============================================
+
+module.exports['JPDecoder: buffers at most maxBytes'] = test => {
+    // The whole-input buffering must honor the caller's download limit: without the
+    // bound a server could defeat maxBytes just by labelling a part with a Japanese
+    // charset, since nothing is emitted (and limited) until _flush
+    let decoder = new JPDecoder('iso-2022-jp', 8);
+    decoder.resume();
+
+    decoder.write(Buffer.from('hello '));
+    decoder.write(Buffer.from('world'));
+
+    test.equal(decoder.chunklen, 8);
+    test.equal(Buffer.concat(decoder.chunks).toString(), 'hello wo');
+    decoder.end();
+    test.done();
+};
+
+module.exports['JPDecoder: a fractional maxBytes still bounds the decoder'] = test => {
+    // A computed limit (a percentage of a budget, say) is not an integer, and silently turning
+    // that into "no limit at all" is exactly the exposure the bound exists to close
+    const decoder = new JPDecoder('sjis', 512.5);
+    test.equal(decoder.maxBytes, 512, 'a fractional bound is floored to a whole byte count');
+    decoder.resume();
+    decoder.write(Buffer.alloc(1024, 0x61));
+    test.equal(decoder.chunklen, 512, 'nothing beyond the bound is buffered');
+    test.equal(decoder.limited, true, 'the decoder reports that it is full');
+    decoder.end();
+    test.done();
+};
+
+module.exports['JPDecoder: a non-numeric maxBytes leaves the decoder unbounded'] = test => {
+    test.equal(new JPDecoder('sjis').maxBytes, Infinity);
+    test.equal(new JPDecoder('sjis', Infinity).maxBytes, Infinity);
+    test.equal(new JPDecoder('sjis', 'lots').maxBytes, Infinity);
+    test.equal(new JPDecoder('sjis', -1).maxBytes, Infinity);
+    test.equal(new JPDecoder('sjis').limited, false);
+    test.done();
+};
+
+module.exports['JPDecoder: reports limited once the bound is reached'] = test => {
+    // The decoder emits nothing until _flush, so a limiter downstream cannot tell that it is
+    // full - the download loop reads this flag instead to stop pulling from the server
+    const decoder = new JPDecoder('sjis', 10);
+    decoder.resume();
+    test.equal(decoder.limited, false);
+    decoder.write(Buffer.alloc(4, 0x61));
+    test.equal(decoder.limited, false, 'not full yet');
+    decoder.write(Buffer.alloc(6, 0x61));
+    test.equal(decoder.limited, true);
+    test.equal(decoder.chunklen, 10);
+    decoder.end();
+    test.done();
+};