imapflow 2.3.0 → 2.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +19 -0
- package/SECURITY.md +126 -55
- package/dist/cjs/commands/append.d.ts +1 -1
- package/dist/cjs/commands/append.js +15 -4
- package/dist/cjs/commands/compress.js +2 -2
- package/dist/cjs/commands/idle.js +2 -3
- package/dist/cjs/commands/status.js +2 -4
- package/dist/cjs/connection-deadline.d.ts +1 -1
- package/dist/cjs/connection-deadline.js +2 -4
- package/dist/cjs/download.js +22 -19
- package/dist/cjs/errors.d.ts +15 -0
- package/dist/cjs/errors.js +22 -0
- package/dist/cjs/handler/imap-compiler.d.ts +4 -4
- package/dist/cjs/handler/imap-compiler.js +18 -18
- package/dist/cjs/handler/imap-parser.js +28 -3
- package/dist/cjs/handler/imap-stream.js +9 -8
- package/dist/cjs/handler/limits.d.ts +1 -1
- package/dist/cjs/handler/limits.js +5 -7
- package/dist/cjs/handler/parser-instance.js +23 -38
- package/dist/cjs/handler/token-parser.d.ts +12 -0
- package/dist/cjs/handler/token-parser.js +44 -104
- package/dist/cjs/imap-flow.d.ts +4 -3
- package/dist/cjs/imap-flow.js +72 -72
- package/dist/cjs/package-info.d.ts +1 -1
- package/dist/cjs/package-info.js +1 -1
- package/dist/cjs/proxy-connection.js +2 -5
- package/dist/cjs/search-compiler.js +2 -3
- package/dist/cjs/tools.d.ts +2 -2
- package/dist/cjs/tools.js +8 -11
- package/dist/esm/commands/append.d.ts +1 -1
- package/dist/esm/commands/append.js +15 -4
- package/dist/esm/commands/compress.js +2 -2
- package/dist/esm/commands/idle.js +2 -3
- package/dist/esm/commands/status.js +2 -4
- package/dist/esm/connection-deadline.d.ts +1 -1
- package/dist/esm/connection-deadline.js +2 -4
- package/dist/esm/download.js +22 -19
- package/dist/esm/errors.d.ts +15 -0
- package/dist/esm/errors.js +21 -0
- package/dist/esm/handler/imap-compiler.d.ts +4 -4
- package/dist/esm/handler/imap-compiler.js +18 -18
- package/dist/esm/handler/imap-parser.js +28 -3
- package/dist/esm/handler/imap-stream.js +9 -8
- package/dist/esm/handler/limits.d.ts +1 -1
- package/dist/esm/handler/limits.js +5 -7
- package/dist/esm/handler/parser-instance.js +23 -38
- package/dist/esm/handler/token-parser.d.ts +12 -0
- package/dist/esm/handler/token-parser.js +44 -104
- package/dist/esm/imap-flow.d.ts +4 -3
- package/dist/esm/imap-flow.js +73 -73
- package/dist/esm/package-info.d.ts +1 -1
- package/dist/esm/package-info.js +1 -1
- package/dist/esm/proxy-connection.js +2 -5
- package/dist/esm/search-compiler.js +2 -3
- package/dist/esm/tools.d.ts +2 -2
- package/dist/esm/tools.js +9 -12
- package/package.json +6 -6
package/dist/esm/download.js
CHANGED
|
@@ -11,6 +11,7 @@ import { LimitedPassthrough, normalizeByteLimit } from './limited-passthrough.js
|
|
|
11
11
|
// What a wait on the head stream listens for: it can take more input, it failed, or it went
|
|
12
12
|
// away (a consumer destroying it closes it without a 'drain')
|
|
13
13
|
const DRAIN_WAIT_EVENTS = ['drain', 'error', 'close'];
|
|
14
|
+
import { createImapError } from './errors.js';
|
|
14
15
|
import { getDecoder, isUnsafeKey } from './tools.js';
|
|
15
16
|
const isEmptySection = (value) => !value?.length;
|
|
16
17
|
/**
|
|
@@ -81,10 +82,7 @@ async function fetchExpected(client, range, query, options, expected) {
|
|
|
81
82
|
cid: client.id
|
|
82
83
|
});
|
|
83
84
|
if (attempt >= MAX_FETCH_ATTEMPTS) {
|
|
84
|
-
|
|
85
|
-
err.code = 'DownloadIncomplete';
|
|
86
|
-
err.cid = client.id;
|
|
87
|
-
throw err;
|
|
85
|
+
throw createImapError('Server kept answering with data of another request', 'DownloadIncomplete', { cid: client.id });
|
|
88
86
|
}
|
|
89
87
|
}
|
|
90
88
|
}
|
|
@@ -231,6 +229,12 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
231
229
|
};
|
|
232
230
|
let response = await fetchExpected(client, range, query, downloadOptions, expected);
|
|
233
231
|
if (!response) {
|
|
232
|
+
// An empty answer also comes from a connection that closed while the consumer was
|
|
233
|
+
// paused between chunks (fetchOne() finds no mailbox then), and that is not a
|
|
234
|
+
// missing message: a caller that retries would skip it
|
|
235
|
+
if (!client.usable) {
|
|
236
|
+
throw client.createNoConnectionError(false, { rejectedFrom: 'download' });
|
|
237
|
+
}
|
|
234
238
|
return { response: false, chunk: false };
|
|
235
239
|
}
|
|
236
240
|
if (!uid && response.uid) {
|
|
@@ -367,13 +371,19 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
367
371
|
// would still pull the entire part off the wire.
|
|
368
372
|
let limiters = [];
|
|
369
373
|
let isLimited = () => limiters.some(entry => entry.limited);
|
|
374
|
+
// Every stage after the head, so a download that ends early can release all of them
|
|
375
|
+
let stages = [];
|
|
370
376
|
// Appending a stage means forwarding the current tail's errors to it before piping, so a
|
|
371
|
-
// failure anywhere reaches the stream the caller is reading
|
|
377
|
+
// failure anywhere reaches the stream the caller is reading. The stage is destroyed with
|
|
378
|
+
// the error rather than only emitting it: pipe() does not end its destination on a source
|
|
379
|
+
// error, so a consumer that only listens for 'finish' or 'close' (a plain .pipe() into a
|
|
380
|
+
// file) would otherwise wait forever.
|
|
372
381
|
let pipeStage = (stage) => {
|
|
373
382
|
output.on('error', err => {
|
|
374
|
-
stage.
|
|
383
|
+
stage.destroy(err);
|
|
375
384
|
});
|
|
376
385
|
output = output.pipe(stage);
|
|
386
|
+
stages.push(stage);
|
|
377
387
|
return stage;
|
|
378
388
|
};
|
|
379
389
|
let isTextNode = ['text/html', 'text/plain', 'text/x-amp-html'].includes(meta.contentType) || (part === '1' && !meta.contentType);
|
|
@@ -418,8 +428,8 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
418
428
|
// Cleanup function
|
|
419
429
|
const cleanup = () => {
|
|
420
430
|
fetchAborted = true;
|
|
421
|
-
|
|
422
|
-
|
|
431
|
+
for (let entry of [stream, ...stages]) {
|
|
432
|
+
entry.destroy();
|
|
423
433
|
}
|
|
424
434
|
};
|
|
425
435
|
// Listen for stream destruction
|
|
@@ -492,11 +502,7 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
492
502
|
// Loud on purpose. Everything written downstream by this point holds
|
|
493
503
|
// duplicated content, and a quiet stop is indistinguishable from a clean EOF,
|
|
494
504
|
// so the consumer would store a corrupt body believing it intact.
|
|
495
|
-
|
|
496
|
-
err.code = 'DownloadOverflow';
|
|
497
|
-
err.maxSize = maxTotalBytes;
|
|
498
|
-
err.cid = client.id;
|
|
499
|
-
throw err;
|
|
505
|
+
throw createImapError('Download exceeded the expected message size', 'DownloadOverflow', { maxSize: maxTotalBytes, cid: client.id });
|
|
500
506
|
}
|
|
501
507
|
let { response, chunk } = await getNextPart();
|
|
502
508
|
// A consumer that gave up while the chunk was in flight
|
|
@@ -507,10 +513,7 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
507
513
|
// The message is gone mid-download (expunged by another client, or the
|
|
508
514
|
// mailbox was closed). Ending the stream here would pass the truncated body
|
|
509
515
|
// off as complete, so the consumer is told the same way as for an overflow.
|
|
510
|
-
|
|
511
|
-
err.code = 'DownloadIncomplete';
|
|
512
|
-
err.cid = client.id;
|
|
513
|
-
throw err;
|
|
516
|
+
throw createImapError('Message disappeared before the download completed', 'DownloadIncomplete', { cid: client.id });
|
|
514
517
|
}
|
|
515
518
|
if (!chunk) {
|
|
516
519
|
break;
|
|
@@ -540,7 +543,7 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
540
543
|
fetchAllParts(head)
|
|
541
544
|
.catch(err => {
|
|
542
545
|
if (!fetchAborted && stream && !stream.destroyed) {
|
|
543
|
-
stream.
|
|
546
|
+
stream.destroy(err);
|
|
544
547
|
/* c8 ignore start */ // the else logs when a fetch error arrives after the stream was already torn down (timing-dependent)
|
|
545
548
|
}
|
|
546
549
|
else {
|
|
@@ -565,7 +568,7 @@ export async function downloadMessage(client, range, part, options) {
|
|
|
565
568
|
// above rejects a promise nobody holds and takes the process down on
|
|
566
569
|
// unhandledRejection. Reaching it always means an invariant broke - the head
|
|
567
570
|
// stream kept pipeStage()'s error forwarder for the life of the download, so
|
|
568
|
-
//
|
|
571
|
+
// destroy(err) above has somewhere to go - which is why it logs at error even
|
|
569
572
|
// for a routine-looking connection code.
|
|
570
573
|
.catch(err => client.log.error({ msg: 'Failed to fail the download stream', err, cid: client.id }));
|
|
571
574
|
};
|
package/dist/esm/errors.d.ts
CHANGED
|
@@ -29,6 +29,7 @@ export declare const ImapFlowErrorCode: {
|
|
|
29
29
|
readonly MissingServerExtension: "MissingServerExtension";
|
|
30
30
|
readonly ParserError: "ParserError";
|
|
31
31
|
readonly ParserErrorExchange: "ParserErrorExchange";
|
|
32
|
+
readonly ParserErrorInternal: "ParserErrorInternal";
|
|
32
33
|
readonly MAX_IMAP_NESTING_REACHED: "MAX_IMAP_NESTING_REACHED";
|
|
33
34
|
readonly LineTooLarge: "LineTooLarge";
|
|
34
35
|
readonly LiteralTooLarge: "LiteralTooLarge";
|
|
@@ -38,6 +39,7 @@ export declare const ImapFlowErrorCode: {
|
|
|
38
39
|
readonly InvalidTextValue: "InvalidTextValue";
|
|
39
40
|
readonly InvalidSequenceSet: "InvalidSequenceSet";
|
|
40
41
|
readonly InvalidSearchQuery: "InvalidSearchQuery";
|
|
42
|
+
readonly InvalidMessageContent: "InvalidMessageContent";
|
|
41
43
|
readonly DownloadOverflow: "DownloadOverflow";
|
|
42
44
|
readonly DownloadIncomplete: "DownloadIncomplete";
|
|
43
45
|
readonly ProxyError: "ProxyError";
|
|
@@ -48,6 +50,8 @@ export declare const ImapFlowErrorCode: {
|
|
|
48
50
|
};
|
|
49
51
|
/** One of the {@link ImapFlowErrorCode} values */
|
|
50
52
|
export type ImapFlowErrorCode = (typeof ImapFlowErrorCode)[keyof typeof ImapFlowErrorCode];
|
|
53
|
+
/** A numbered parser error code, `ParserError1` and up */
|
|
54
|
+
export type ParserErrorCode = `ParserError${number}`;
|
|
51
55
|
/**
|
|
52
56
|
* An Error raised by ImapFlow, with the extra properties the library attaches to describe
|
|
53
57
|
* the failure. Every property is optional: which ones are present depends on where the
|
|
@@ -132,3 +136,14 @@ export declare class AuthenticationFailure extends Error implements ImapFlowErro
|
|
|
132
136
|
response?: string | undefined;
|
|
133
137
|
oauthError?: any;
|
|
134
138
|
}
|
|
139
|
+
/**
|
|
140
|
+
* Creates an {@link ImapFlowError} with a code and optional extra properties. The code is
|
|
141
|
+
* checked by the compiler against {@link ImapFlowErrorCode}, so a typo or an undeclared
|
|
142
|
+
* code fails the build instead of reaching consumers.
|
|
143
|
+
*
|
|
144
|
+
* @param message - The error message
|
|
145
|
+
* @param code - The error code
|
|
146
|
+
* @param props - Extra properties to set on the error
|
|
147
|
+
* @returns The error, ready to throw or reject with
|
|
148
|
+
*/
|
|
149
|
+
export declare function createImapError(message: string, code: ImapFlowErrorCode | ParserErrorCode, props?: Omit<ImapFlowError, 'name' | 'message' | 'stack' | 'code'> | undefined): ImapFlowError;
|
package/dist/esm/errors.js
CHANGED
|
@@ -32,6 +32,8 @@ export const ImapFlowErrorCode = {
|
|
|
32
32
|
// response parsing and size limits
|
|
33
33
|
ParserError: 'ParserError',
|
|
34
34
|
ParserErrorExchange: 'ParserErrorExchange',
|
|
35
|
+
// an unexpected exception inside the parser, re-raised with a code; a parser bug
|
|
36
|
+
ParserErrorInternal: 'ParserErrorInternal',
|
|
35
37
|
MAX_IMAP_NESTING_REACHED: 'MAX_IMAP_NESTING_REACHED',
|
|
36
38
|
LineTooLarge: 'LineTooLarge',
|
|
37
39
|
LiteralTooLarge: 'LiteralTooLarge',
|
|
@@ -42,6 +44,7 @@ export const ImapFlowErrorCode = {
|
|
|
42
44
|
InvalidTextValue: 'InvalidTextValue',
|
|
43
45
|
InvalidSequenceSet: 'InvalidSequenceSet',
|
|
44
46
|
InvalidSearchQuery: 'InvalidSearchQuery',
|
|
47
|
+
InvalidMessageContent: 'InvalidMessageContent',
|
|
45
48
|
// download()
|
|
46
49
|
DownloadOverflow: 'DownloadOverflow',
|
|
47
50
|
DownloadIncomplete: 'DownloadIncomplete',
|
|
@@ -62,3 +65,21 @@ export class AuthenticationFailure extends Error {
|
|
|
62
65
|
this.authenticationFailed = true;
|
|
63
66
|
}
|
|
64
67
|
}
|
|
68
|
+
/**
|
|
69
|
+
* Creates an {@link ImapFlowError} with a code and optional extra properties. The code is
|
|
70
|
+
* checked by the compiler against {@link ImapFlowErrorCode}, so a typo or an undeclared
|
|
71
|
+
* code fails the build instead of reaching consumers.
|
|
72
|
+
*
|
|
73
|
+
* @param message - The error message
|
|
74
|
+
* @param code - The error code
|
|
75
|
+
* @param props - Extra properties to set on the error
|
|
76
|
+
* @returns The error, ready to throw or reject with
|
|
77
|
+
*/
|
|
78
|
+
export function createImapError(message, code, props) {
|
|
79
|
+
const error = new Error(message);
|
|
80
|
+
error.code = code;
|
|
81
|
+
if (props) {
|
|
82
|
+
Object.assign(error, props);
|
|
83
|
+
}
|
|
84
|
+
return error;
|
|
85
|
+
}
|
|
@@ -12,13 +12,13 @@ import type { CompilerOptions, ImapCompileInput } from './types.js';
|
|
|
12
12
|
* @param options.isLogging - If true, redacts sensitive values and truncates long strings/literals for logging purposes.
|
|
13
13
|
* @param options.literalPlus - If true, uses the LITERAL+ extension (appends "+" to literal length markers).
|
|
14
14
|
* @param options.literalMinus - If true, uses the LITERAL- extension for literals up to 4096 bytes.
|
|
15
|
-
* @returns
|
|
15
|
+
* @returns An array of Buffers (if asArray is true) or a single concatenated Buffer.
|
|
16
16
|
*/
|
|
17
17
|
declare function compiler(response: ImapCompileInput, options: CompilerOptions & {
|
|
18
18
|
asArray: true;
|
|
19
|
-
}):
|
|
19
|
+
}): Buffer[];
|
|
20
20
|
declare function compiler(response: ImapCompileInput, options?: (CompilerOptions & {
|
|
21
21
|
asArray?: false | undefined;
|
|
22
|
-
}) | undefined):
|
|
23
|
-
declare function compiler(response: ImapCompileInput, options?: CompilerOptions | undefined):
|
|
22
|
+
}) | undefined): Buffer;
|
|
23
|
+
declare function compiler(response: ImapCompileInput, options?: CompilerOptions | undefined): Buffer | Buffer[];
|
|
24
24
|
export default compiler;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
/* eslint no-console: 0, new-cap: 0 */
|
|
2
2
|
import imapFormalSyntax from './imap-formal-syntax.js';
|
|
3
|
+
import { createImapError } from '../errors.js';
|
|
3
4
|
// A single element of a sequence-set as defined by the RFC 9051 grammar: a number
|
|
4
5
|
// or a range, where "*" stands for the largest number in use. Digit strings are not
|
|
5
6
|
// range-checked here (a server rejects "0" or an overlong number on its own); the
|
|
@@ -41,13 +42,11 @@ const CRLF = /[\r\n]/;
|
|
|
41
42
|
*/
|
|
42
43
|
const quoteString = (value) => {
|
|
43
44
|
if (NOT_QUOTABLE.test(value)) {
|
|
44
|
-
|
|
45
|
-
error.code = 'InvalidStringValue';
|
|
46
|
-
throw error;
|
|
45
|
+
throw createImapError('Unquotable character in IMAP string value', 'InvalidStringValue');
|
|
47
46
|
}
|
|
48
47
|
return '"' + value.replace(/["\\]/g, char => '\\' + char) + '"';
|
|
49
48
|
};
|
|
50
|
-
|
|
49
|
+
function compiler(response, options) {
|
|
51
50
|
let { asArray, isLogging, literalPlus, literalMinus } = options || {};
|
|
52
51
|
const respParts = [];
|
|
53
52
|
// Formats an entry (string, number or Buffer) into the Buffer that is written to
|
|
@@ -62,9 +61,7 @@ async function compiler(response, options) {
|
|
|
62
61
|
const emitEntry = (entry, opts) => {
|
|
63
62
|
let { returnEmpty, raw } = opts || {};
|
|
64
63
|
if (!raw && !isLogging && (typeof entry === 'string' || Buffer.isBuffer(entry)) && CRLF.test(entry.toString('latin1'))) {
|
|
65
|
-
|
|
66
|
-
error.code = 'InvalidTokenValue';
|
|
67
|
-
throw error;
|
|
64
|
+
throw createImapError('Line terminator in IMAP token', 'InvalidTokenValue');
|
|
68
65
|
}
|
|
69
66
|
if (typeof entry === 'string') {
|
|
70
67
|
return Buffer.from(entry);
|
|
@@ -88,7 +85,7 @@ async function compiler(response, options) {
|
|
|
88
85
|
// Set right after the compiler writes "(" or "[" itself, so the first element inside gets no
|
|
89
86
|
// leading space
|
|
90
87
|
let afterOpener = false;
|
|
91
|
-
let walk =
|
|
88
|
+
let walk = (node, options) => {
|
|
92
89
|
options = options || {};
|
|
93
90
|
// Add a space separator when:
|
|
94
91
|
// - The previous token was a LITERAL. Literal data ends exactly at its declared length, so
|
|
@@ -120,7 +117,7 @@ async function compiler(response, options) {
|
|
|
120
117
|
if (subArray && !Array.isArray(child)) {
|
|
121
118
|
subArray = false;
|
|
122
119
|
}
|
|
123
|
-
|
|
120
|
+
walk(child, { subArray });
|
|
124
121
|
}
|
|
125
122
|
resp.push(emitEntry(')'));
|
|
126
123
|
afterOpener = false;
|
|
@@ -154,6 +151,11 @@ async function compiler(response, options) {
|
|
|
154
151
|
resp.push(emitEntry(logPlaceholder(node.value.length, 'literal')));
|
|
155
152
|
}
|
|
156
153
|
else {
|
|
154
|
+
// The size marker must match the bytes emitEntry() writes, and it writes
|
|
155
|
+
// nothing for a value that is not a Buffer or a string
|
|
156
|
+
if (node.value && !Buffer.isBuffer(node.value) && typeof node.value !== 'string') {
|
|
157
|
+
throw createImapError('Literal value must be a Buffer or a string', 'InvalidTokenValue');
|
|
158
|
+
}
|
|
157
159
|
// The literal size marker counts octets - string values are written as
|
|
158
160
|
// UTF-8, so their UTF-16 .length would undercount multi-byte characters
|
|
159
161
|
let literalLength = !node.value ? 0 : Buffer.isBuffer(node.value) ? node.value.length : Buffer.byteLength(node.value.toString());
|
|
@@ -208,9 +210,7 @@ async function compiler(response, options) {
|
|
|
208
210
|
if (!isLogging) {
|
|
209
211
|
val = node.value === null || node.value === undefined ? '' : node.value.toString();
|
|
210
212
|
if (!isValidSequenceSet(val)) {
|
|
211
|
-
|
|
212
|
-
error.code = 'InvalidSequenceSet';
|
|
213
|
-
throw error;
|
|
213
|
+
throw createImapError('Invalid sequence set value', 'InvalidSequenceSet');
|
|
214
214
|
}
|
|
215
215
|
resp.push(emitEntry(val, { raw: true }));
|
|
216
216
|
}
|
|
@@ -225,9 +225,7 @@ async function compiler(response, options) {
|
|
|
225
225
|
// this check runs first only to raise the more specific InvalidTextValue code.
|
|
226
226
|
if (node.value) {
|
|
227
227
|
if (!isLogging && CRLF.test(node.value.toString())) {
|
|
228
|
-
|
|
229
|
-
error.code = 'InvalidTextValue';
|
|
230
|
-
throw error;
|
|
228
|
+
throw createImapError('Line terminator in IMAP text value', 'InvalidTextValue');
|
|
231
229
|
}
|
|
232
230
|
resp.push(emitEntry(node.value));
|
|
233
231
|
}
|
|
@@ -262,7 +260,7 @@ async function compiler(response, options) {
|
|
|
262
260
|
resp.push(emitEntry('['));
|
|
263
261
|
afterOpener = true;
|
|
264
262
|
for (let child of node.section) {
|
|
265
|
-
|
|
263
|
+
walk(child);
|
|
266
264
|
}
|
|
267
265
|
resp.push(emitEntry(']'));
|
|
268
266
|
afterOpener = false;
|
|
@@ -281,13 +279,15 @@ async function compiler(response, options) {
|
|
|
281
279
|
if (response.attributes) {
|
|
282
280
|
let attributes = Array.isArray(response.attributes) ? response.attributes : [].concat(response.attributes);
|
|
283
281
|
for (let child of attributes) {
|
|
284
|
-
|
|
282
|
+
walk(child);
|
|
285
283
|
}
|
|
286
284
|
}
|
|
287
285
|
if (resp.length) {
|
|
288
286
|
respParts.push(resp);
|
|
289
287
|
}
|
|
290
|
-
|
|
288
|
+
// A part with a single entry (the data of a synchronizing literal) is used as is: copying a
|
|
289
|
+
// large message only to send it doubles its memory
|
|
290
|
+
const compiled = respParts.map(part => (part.length === 1 ? part[0] : Buffer.concat(part)));
|
|
291
291
|
// without asArray there is a single part, returned as is instead of copied
|
|
292
292
|
return asArray ? compiled : compiled.length === 1 ? compiled[0] : Buffer.concat(compiled);
|
|
293
293
|
}
|
|
@@ -1,5 +1,30 @@
|
|
|
1
1
|
import imapFormalSyntax from './imap-formal-syntax.js';
|
|
2
2
|
import { ParserInstance } from './parser-instance.js';
|
|
3
|
+
import { createImapError } from '../errors.js';
|
|
4
|
+
import { boundedInput } from './limits.js';
|
|
5
|
+
// The codes the parser raises on purpose: the numbered ParserErrorN codes, ParserErrorExchange,
|
|
6
|
+
// the nesting limit and the inline literal size limit
|
|
7
|
+
const PARSER_ERROR_CODES = /^(?:ParserError\d+|ParserErrorExchange|MAX_IMAP_NESTING_REACHED|LiteralTooLarge)$/;
|
|
8
|
+
/**
|
|
9
|
+
* Anything the parser throws other than one of its own coded errors - a TypeError from a parser
|
|
10
|
+
* bug, a RangeError from runaway recursion or a bad Buffer offset (which carries a Node code), a
|
|
11
|
+
* thrown non-Error - is re-raised as a coded `ParserErrorInternal`, so callers that match on
|
|
12
|
+
* codes still handle it and settle the command the line belonged to. The fuzz suite treats this
|
|
13
|
+
* code as a failure, so the guard does not hide parser bugs from the tests.
|
|
14
|
+
*
|
|
15
|
+
* @param err - The thrown value
|
|
16
|
+
* @param input - The line that was being parsed
|
|
17
|
+
* @returns The error to rethrow
|
|
18
|
+
*/
|
|
19
|
+
function asParserError(err, input) {
|
|
20
|
+
if (err instanceof Error && PARSER_ERROR_CODES.test(err.code || '')) {
|
|
21
|
+
return err;
|
|
22
|
+
}
|
|
23
|
+
return createImapError(`Unexpected parser failure: ${err instanceof Error ? err.message : String(err)}`, 'ParserErrorInternal', {
|
|
24
|
+
parserContext: boundedInput(input.toString()),
|
|
25
|
+
...(err instanceof Error ? { _err: err } : {})
|
|
26
|
+
});
|
|
27
|
+
}
|
|
3
28
|
/**
|
|
4
29
|
* Parses a raw IMAP command or response buffer into a structured object.
|
|
5
30
|
* Handles edge cases such as null-byte-padded responses from buggy servers and
|
|
@@ -20,7 +45,7 @@ export default async function parser(command, options) {
|
|
|
20
45
|
// Workaround for buggy IMAP servers that pad responses with leading NUL (\x00) bytes.
|
|
21
46
|
// Some servers (observed in the wild) prepend null bytes to their output, which would
|
|
22
47
|
// cause parsing to fail. We strip them and note how many were removed for diagnostics.
|
|
23
|
-
if (command[0] === 0) {
|
|
48
|
+
if (Buffer.isBuffer(command) && command[0] === 0) {
|
|
24
49
|
// find the first non null byte and trim
|
|
25
50
|
let firstNonNull = -1;
|
|
26
51
|
for (let i = 0; i < command.length; i++) {
|
|
@@ -33,7 +58,7 @@ export default async function parser(command, options) {
|
|
|
33
58
|
// All bytes are null, treat as a BAD response
|
|
34
59
|
return { tag: '*', command: 'BAD', attributes: [] };
|
|
35
60
|
}
|
|
36
|
-
command = command.
|
|
61
|
+
command = command.subarray(firstNonNull);
|
|
37
62
|
nullBytesRemoved = firstNonNull;
|
|
38
63
|
}
|
|
39
64
|
const parserInstance = new ParserInstance(command, options);
|
|
@@ -65,7 +90,7 @@ export default async function parser(command, options) {
|
|
|
65
90
|
}
|
|
66
91
|
}
|
|
67
92
|
catch (err) {
|
|
68
|
-
let error = err;
|
|
93
|
+
let error = asParserError(err, command);
|
|
69
94
|
if (error.code === 'ParserErrorExchange' && error.parserContext && error.parserContext.value) {
|
|
70
95
|
return error.parserContext.value;
|
|
71
96
|
}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { Transform } from 'node:stream';
|
|
2
2
|
import { createConnectionLogger } from '../logger.js';
|
|
3
3
|
import { MAX_LITERAL_SIZE, MAX_LINE_SIZE, MAX_RESPONSE_SIZE, normalizeLimit, createLiteralTooLargeError } from './limits.js';
|
|
4
|
+
import { createImapError } from '../errors.js';
|
|
4
5
|
const LINE = 0x01;
|
|
5
6
|
const LITERAL = 0x02;
|
|
6
7
|
const LF = 0x0a;
|
|
@@ -177,10 +178,10 @@ export class ImapStream extends Transform {
|
|
|
177
178
|
if (lineLength <= this.maxLineLength) {
|
|
178
179
|
return true;
|
|
179
180
|
}
|
|
180
|
-
const err =
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
181
|
+
const err = createImapError(`Line length ${lineLength} exceeds maximum allowed size of ${this.maxLineLength} bytes`, 'LineTooLarge', {
|
|
182
|
+
lineLength,
|
|
183
|
+
maxSize: this.maxLineLength
|
|
184
|
+
});
|
|
184
185
|
return this.failStream(err);
|
|
185
186
|
}
|
|
186
187
|
/**
|
|
@@ -203,10 +204,10 @@ export class ImapStream extends Transform {
|
|
|
203
204
|
}
|
|
204
205
|
return true;
|
|
205
206
|
}
|
|
206
|
-
const err =
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
207
|
+
const err = createImapError(`Response size ${total} exceeds maximum allowed size of ${this.maxResponseSize} bytes`, 'ResponseTooLarge', {
|
|
208
|
+
responseSize: total,
|
|
209
|
+
maxSize: this.maxResponseSize
|
|
210
|
+
});
|
|
210
211
|
return this.failStream(err);
|
|
211
212
|
}
|
|
212
213
|
/**
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
// Shared response-size limits for the IMAP parser. Kept in one place so the streaming parser
|
|
2
2
|
// (ImapStream) and the standalone token parser cannot drift apart, and so the documented
|
|
3
3
|
// defaults in the ImapFlowOptions type describe both paths.
|
|
4
|
+
import { createImapError } from '../errors.js';
|
|
4
5
|
// Maximum allowed literal size: 1GB (1073741824 bytes)
|
|
5
6
|
export const MAX_LITERAL_SIZE = 1024 * 1024 * 1024;
|
|
6
7
|
// Default maximum length of a single line (a response without a literal). Matches the literal cap:
|
|
@@ -51,10 +52,7 @@ export const normalizeLimit = (value, defaultValue) => (Number.isInteger(value)
|
|
|
51
52
|
* @param reason - What the bound was, when it is not the configured maximum.
|
|
52
53
|
* @returns The error to emit or throw.
|
|
53
54
|
*/
|
|
54
|
-
export const createLiteralTooLargeError = (literalSize, maxSize, reason) => {
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
err.maxSize = maxSize;
|
|
59
|
-
return err;
|
|
60
|
-
};
|
|
55
|
+
export const createLiteralTooLargeError = (literalSize, maxSize, reason) => createImapError(`Literal size ${literalSize} exceeds ${reason || `maximum allowed size of ${maxSize} bytes`}`, 'LiteralTooLarge', {
|
|
56
|
+
literalSize,
|
|
57
|
+
maxSize
|
|
58
|
+
});
|
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
import imapFormalSyntax from './imap-formal-syntax.js';
|
|
3
3
|
import { TokenParser } from './token-parser.js';
|
|
4
4
|
import { boundedInput } from './limits.js';
|
|
5
|
+
import { createImapError } from '../errors.js';
|
|
5
6
|
/**
|
|
6
7
|
* Parses a single IMAP response line into its structural components: tag, command,
|
|
7
8
|
* and attributes. Handles status responses (OK, NO, BAD, PREAUTH, BYE) with their
|
|
@@ -137,10 +138,7 @@ export class ParserInstance {
|
|
|
137
138
|
async getElement(syntax) {
|
|
138
139
|
let match, element, errPos;
|
|
139
140
|
if (/^\s/.test(this.remainder)) {
|
|
140
|
-
|
|
141
|
-
error.code = 'ParserError1';
|
|
142
|
-
error.parserContext = this.errorContext();
|
|
143
|
-
throw error;
|
|
141
|
+
throw createImapError(`Unexpected whitespace at position ${this.pos} [E1]`, 'ParserError1', { parserContext: this.errorContext() });
|
|
144
142
|
}
|
|
145
143
|
if ((match = this.remainder.match(/^\s*[^\s]+(?=\s|$)/))) {
|
|
146
144
|
element = match[0];
|
|
@@ -150,29 +148,24 @@ export class ParserInstance {
|
|
|
150
148
|
// "Server Unavailable." instead of a proper IMAP tagged/untagged response.
|
|
151
149
|
// We detect this specific pattern and convert it into a synthetic BAD response
|
|
152
150
|
// so the rest of the parser can handle it gracefully.
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
151
|
+
throw createImapError(`Server returned an error: ${this.input}`, 'ParserErrorExchange', {
|
|
152
|
+
parserContext: {
|
|
153
|
+
...this.errorContext(element),
|
|
154
|
+
value: {
|
|
155
|
+
tag: '*',
|
|
156
|
+
command: 'BAD',
|
|
157
|
+
attributes: [{ type: 'TEXT', value: this.input }]
|
|
158
|
+
}
|
|
161
159
|
}
|
|
162
|
-
};
|
|
163
|
-
throw error;
|
|
160
|
+
});
|
|
164
161
|
}
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
throw error;
|
|
162
|
+
throw createImapError(`Unexpected char at position ${this.pos + errPos} [E2: ${JSON.stringify(element.charAt(errPos))}]`, 'ParserError2', {
|
|
163
|
+
parserContext: this.errorContext(element)
|
|
164
|
+
});
|
|
169
165
|
}
|
|
170
166
|
}
|
|
171
167
|
else {
|
|
172
|
-
|
|
173
|
-
error.code = 'ParserError3';
|
|
174
|
-
error.parserContext = this.errorContext();
|
|
175
|
-
throw error;
|
|
168
|
+
throw createImapError(`Unexpected end of input at position ${this.pos} [E3]`, 'ParserError3', { parserContext: this.errorContext() });
|
|
176
169
|
}
|
|
177
170
|
this.pos += match[0].length;
|
|
178
171
|
this.remainder = this.remainder.slice(match[0].length);
|
|
@@ -190,16 +183,12 @@ export class ParserInstance {
|
|
|
190
183
|
// special case, empty + response
|
|
191
184
|
return;
|
|
192
185
|
}
|
|
193
|
-
|
|
194
|
-
error.code = 'ParserError4';
|
|
195
|
-
error.parserContext = this.errorContext();
|
|
196
|
-
throw error;
|
|
186
|
+
throw createImapError(`Unexpected end of input at position ${this.pos} [E4]`, 'ParserError4', { parserContext: this.errorContext() });
|
|
197
187
|
}
|
|
198
188
|
if (imapFormalSyntax.verify(this.remainder.charAt(0), imapFormalSyntax.SP()) >= 0) {
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
throw error;
|
|
189
|
+
throw createImapError(`Unexpected char at position ${this.pos} [E5: ${JSON.stringify(this.remainder.charAt(0))}]`, 'ParserError5', {
|
|
190
|
+
parserContext: this.errorContext(this.remainder)
|
|
191
|
+
});
|
|
203
192
|
}
|
|
204
193
|
this.pos++;
|
|
205
194
|
this.remainder = this.remainder.slice(1);
|
|
@@ -214,16 +203,12 @@ export class ParserInstance {
|
|
|
214
203
|
*/
|
|
215
204
|
async getAttributes() {
|
|
216
205
|
if (!this.remainder.length) {
|
|
217
|
-
|
|
218
|
-
error.code = 'ParserError6';
|
|
219
|
-
error.parserContext = this.errorContext();
|
|
220
|
-
throw error;
|
|
206
|
+
throw createImapError(`Unexpected end of input at position ${this.pos} [E6]`, 'ParserError6', { parserContext: this.errorContext() });
|
|
221
207
|
}
|
|
222
208
|
if (/^\s/.test(this.remainder)) {
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
throw error;
|
|
209
|
+
throw createImapError(`Unexpected whitespace at position ${this.pos} [E7]`, 'ParserError7', {
|
|
210
|
+
parserContext: this.errorContext(this.remainder)
|
|
211
|
+
});
|
|
227
212
|
}
|
|
228
213
|
const tokenParser = new TokenParser(this, this.pos, this.remainder, this.options);
|
|
229
214
|
return await tokenParser.getAttributes();
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { type ImapFlowError, type ParserErrorCode } from '../errors.js';
|
|
1
2
|
import type { ImapAttributeList, ParserOptions } from './types.js';
|
|
2
3
|
import type { ParserInstance } from './parser-instance.js';
|
|
3
4
|
/**
|
|
@@ -58,6 +59,17 @@ export declare class TokenParser {
|
|
|
58
59
|
* from the input, i.e. when no pre-parsed literal buffers were supplied. Defaults to 1GB.
|
|
59
60
|
*/
|
|
60
61
|
constructor(parent: TokenParserParent | ParserInstance, startPos?: number | undefined, str?: string | null | undefined, options?: ParserOptions | undefined);
|
|
62
|
+
/**
|
|
63
|
+
* Builds a numbered parser error that carries a bounded copy of the input and the position
|
|
64
|
+
* (and character, when there is one) where parsing failed.
|
|
65
|
+
*
|
|
66
|
+
* @param message - The error message
|
|
67
|
+
* @param code - The numbered parser error code
|
|
68
|
+
* @param pos - Position of the failure in the original input
|
|
69
|
+
* @param chr - The offending character
|
|
70
|
+
* @returns The error to throw
|
|
71
|
+
*/
|
|
72
|
+
parserError(message: string, code: ParserErrorCode, pos: number, chr?: string | undefined): ImapFlowError;
|
|
61
73
|
/**
|
|
62
74
|
* Processes the input string and returns the parsed attributes as a flat array of typed objects.
|
|
63
75
|
* Each attribute is an object with a `type` (e.g., "ATOM", "STRING", "LITERAL", "SEQUENCE")
|