imapflow 2.0.1 → 2.0.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [2.0.3](https://github.com/postalsys/imapflow/compare/v2.0.2...v2.0.3) (2026-09-14)
+
+
+### Bug Fixes
+
+* bound the chunked download loop by the reported message size ([fc9b4eb](https://github.com/postalsys/imapflow/commit/fc9b4ebdcc15fbc952fb2a18d98a723511e384ab))
+* stop chunked download when the server ignores the partial spec ([#396](https://github.com/postalsys/imapflow/issues/396)) ([e216fde](https://github.com/postalsys/imapflow/commit/e216fdeaad4724bdeead6f346e207cd3d75a20fd))
+
+## [2.0.2](https://github.com/postalsys/imapflow/compare/v2.0.1...v2.0.2) (2026-09-10)
+
+
+### Bug Fixes
+
+* skip LSUB once a server has rejected ENABLE over the IMAP4rev2 it advertises ([1c4bca2](https://github.com/postalsys/imapflow/commit/1c4bca2349ed05d5cb61a85abb4152630ceb3d73))
+
 ## [2.0.1](https://github.com/postalsys/imapflow/compare/v2.0.0...v2.0.1) (2026-09-10)
 
 

package/dist/cjs/imap-flow.js

@@ -1199,6 +1199,7 @@ class ImapFlow extends node_events_1.EventEmitter {
                 // rejected, so it stays an IMAP4rev1 session (RFC 9051 Appendix A)
                 // with an advertisement the server does not implement - see skipRev2
                 this.skipRev2 = true;
+                this.skipLsub = true;
             }
             // RFC 5161 requires servers to ignore unknown ENABLE arguments, but a
             // broken implementation may reject the whole command over IMAP4rev2 -
@@ -3028,7 +3029,22 @@ class ImapFlow extends node_events_1.EventEmitter {
                 return {};
             }
             processed += chunk.length;
-            hasMore = chunk.length >= chunkSize;
+            // A compliant server returns at most `chunkSize` bytes for a partial
+            // request. Some servers (Tencent Exmail among them) ignore the partial
+            // spec and answer every request with the complete part. That chunk is
+            // then larger than requested, so treating it as "full, keep going"
+            // would advance the offset past the end forever and never see a short
+            // chunk. An oversized answer already contains the whole part - stop.
+            hasMore = chunk.length === chunkSize;
+            if (chunk.length > chunkSize) {
+                this.log.warn({
+                    msg: 'Server returned more than the requested window, treating the part as complete',
+                    chunkSize,
+                    received: chunk.length,
+                    processed,
+                    cid: this.id
+                });
+            }
             let result = { chunk };
             if (query.size) {
                 result.response = response;
@@ -3197,11 +3213,30 @@ class ImapFlow extends node_events_1.EventEmitter {
             }
             return stream.write(chunk);
         };
+        // Ceiling on how many bytes one download may pull off the wire, as the backstop for the
+        // partial-ignoring servers above: a part whose size happens to equal chunkSize exactly
+        // comes back looking like a full window every time, so no test over chunk lengths can end
+        // that loop. RFC822.SIZE bounds any part of the message; doubled for servers that count
+        // line endings differently than they deliver, plus one window so a download sitting right
+        // at the bound still gets its terminating chunk. Infinity when the server reported no
+        // size, which leaves the loop bounded by maxBytes alone.
+        let maxTotalBytes = (0, limited_passthrough_js_1.normalizeByteLimit)(meta.expectedSize ? meta.expectedSize * 2 + chunkSize : 0);
         // Fetch remaining chunks in a loop, writing each to the decoder stream.
-        // Stops when the server returns a short chunk (< chunkSize), the byte
-        // limiter is satisfied, or the consumer destroys the output stream.
+        // Stops when the server returns a short chunk (< chunkSize), answers with more than the
+        // requested window, the byte limiter is satisfied, or the consumer destroys the output
+        // stream. Throws when the ceiling above is crossed.
         let fetchAllParts = async () => {
             while (hasMore && !isLimited() && !fetchAborted) {
+                if (processed >= maxTotalBytes) {
+                    // Loud on purpose. Everything written downstream by this point holds
+                    // duplicated content, and a quiet stop is indistinguishable from a clean EOF,
+                    // so the consumer would store a corrupt body believing it intact.
+                    let err = new Error('Download exceeded the expected message size');
+                    err.code = 'DownloadOverflow';
+                    err.maxSize = maxTotalBytes;
+                    err.cid = this.id;
+                    throw err;
+                }
                 let { chunk } = await getNextPart();
                 if (!chunk || fetchAborted) {
                     break;

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.0.1";
+export declare const version = "2.0.3";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'imapflow';
-exports.version = '2.0.1';
+exports.version = '2.0.3';
 exports.homepage = 'https://imapflow.com/';

package/dist/esm/imap-flow.js

@@ -1159,6 +1159,7 @@ export class ImapFlow extends EventEmitter {
                 // rejected, so it stays an IMAP4rev1 session (RFC 9051 Appendix A)
                 // with an advertisement the server does not implement - see skipRev2
                 this.skipRev2 = true;
+                this.skipLsub = true;
             }
             // RFC 5161 requires servers to ignore unknown ENABLE arguments, but a
             // broken implementation may reject the whole command over IMAP4rev2 -
@@ -2988,7 +2989,22 @@ export class ImapFlow extends EventEmitter {
                 return {};
             }
             processed += chunk.length;
-            hasMore = chunk.length >= chunkSize;
+            // A compliant server returns at most `chunkSize` bytes for a partial
+            // request. Some servers (Tencent Exmail among them) ignore the partial
+            // spec and answer every request with the complete part. That chunk is
+            // then larger than requested, so treating it as "full, keep going"
+            // would advance the offset past the end forever and never see a short
+            // chunk. An oversized answer already contains the whole part - stop.
+            hasMore = chunk.length === chunkSize;
+            if (chunk.length > chunkSize) {
+                this.log.warn({
+                    msg: 'Server returned more than the requested window, treating the part as complete',
+                    chunkSize,
+                    received: chunk.length,
+                    processed,
+                    cid: this.id
+                });
+            }
             let result = { chunk };
             if (query.size) {
                 result.response = response;
@@ -3157,11 +3173,30 @@ export class ImapFlow extends EventEmitter {
             }
             return stream.write(chunk);
         };
+        // Ceiling on how many bytes one download may pull off the wire, as the backstop for the
+        // partial-ignoring servers above: a part whose size happens to equal chunkSize exactly
+        // comes back looking like a full window every time, so no test over chunk lengths can end
+        // that loop. RFC822.SIZE bounds any part of the message; doubled for servers that count
+        // line endings differently than they deliver, plus one window so a download sitting right
+        // at the bound still gets its terminating chunk. Infinity when the server reported no
+        // size, which leaves the loop bounded by maxBytes alone.
+        let maxTotalBytes = normalizeByteLimit(meta.expectedSize ? meta.expectedSize * 2 + chunkSize : 0);
         // Fetch remaining chunks in a loop, writing each to the decoder stream.
-        // Stops when the server returns a short chunk (< chunkSize), the byte
-        // limiter is satisfied, or the consumer destroys the output stream.
+        // Stops when the server returns a short chunk (< chunkSize), answers with more than the
+        // requested window, the byte limiter is satisfied, or the consumer destroys the output
+        // stream. Throws when the ceiling above is crossed.
         let fetchAllParts = async () => {
             while (hasMore && !isLimited() && !fetchAborted) {
+                if (processed >= maxTotalBytes) {
+                    // Loud on purpose. Everything written downstream by this point holds
+                    // duplicated content, and a quiet stop is indistinguishable from a clean EOF,
+                    // so the consumer would store a corrupt body believing it intact.
+                    let err = new Error('Download exceeded the expected message size');
+                    err.code = 'DownloadOverflow';
+                    err.maxSize = maxTotalBytes;
+                    err.cid = this.id;
+                    throw err;
+                }
                 let { chunk } = await getNextPart();
                 if (!chunk || fetchAborted) {
                     break;

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.0.1";
+export declare const version = "2.0.3";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'imapflow';
-export const version = '2.0.1';
+export const version = '2.0.3';
 export const homepage = 'https://imapflow.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.0.1",
+    "version": "2.0.3",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",