imapkit 0.0.0-stage → 4.0.0

package/lib/plugins/appendlimit.js

@@ -0,0 +1,83 @@
+'use strict';
+
+const { getPendingTarget } = require('../commands/append');
+
+/**
+ * @help Adds APPENDLIMIT [RFC7889] capability
+ * @help Server option "appendLimit" sets the limit in octets for all
+ * @help mailboxes, a mailbox in storage can set its own "appendLimit"
+ * @help (null for no limit)
+ *
+ * APPENDLIMIT: https://www.rfc-editor.org/rfc/rfc7889
+ *
+ * The server option "appendLimit" (octets) sets a limit for all mailboxes, advertised as
+ * APPENDLIMIT=<n>. A mailbox in the storage can set its own "appendLimit" (a number, or null
+ * for no limit), then the capability is a plain APPENDLIMIT and clients read the limits with
+ * STATUS (APPENDLIMIT). A larger APPEND or REPLACE fails with NO [TOOBIG], a synchronizing
+ * literal is refused before it is sent.
+ */
+module.exports = function (server) {
+    const serverLimit = 'appendLimit' in server.options ? server.options.appendLimit : null;
+    if (serverLimit !== null && !isValidLimit(serverLimit)) {
+        throw new TypeError('Invalid appendLimit option, expecting a non-negative integer');
+    }
+
+    const hasOwnLimit = mailbox => Object.hasOwn(mailbox, 'appendLimit');
+    const hasMailboxLimits = () => Object.values(server.folderCache).some(hasOwnLimit);
+
+    /**
+     * @param {Object} mailbox Mailbox object
+     * @return {Number|null} limit in octets, null if there is no limit
+     */
+    const getLimit = mailbox => {
+        if (!hasOwnLimit(mailbox)) {
+            return serverLimit;
+        }
+        return isValidLimit(mailbox.appendLimit) ? mailbox.appendLimit : null;
+    };
+
+    // RFC 7889 section 5: an APPENDLIMIT of 0 means that nothing can be appended
+    const isTooBig = (mailbox, size) => {
+        const limit = getLimit(mailbox);
+        return limit !== null && (size > limit || limit === 0);
+    };
+
+    // RFC 7889 section 2: APPENDLIMIT=<n> for the same limit in every mailbox, otherwise a plain
+    // APPENDLIMIT and the limits come from STATUS
+    if (serverLimit !== null) {
+        server.registerCapability('APPENDLIMIT=' + serverLimit, () => !hasMailboxLimits());
+    }
+    server.registerCapability('APPENDLIMIT', () => serverLimit === null || hasMailboxLimits());
+
+    // RFC 7889 section 4: a message over the limit is refused with TOOBIG
+    server.appendChecks.push((connection, mailbox, messages, options) => {
+        // COPY and MOVE are not uploads (RFC 7889 section 1)
+        if (!options.command) {
+            return false;
+        }
+        if (messages.some(message => isTooBig(mailbox, message.raw.length))) {
+            return { code: 'TOOBIG', text: 'Message exceeds the APPENDLIMIT of the mailbox' };
+        }
+        return false;
+    });
+
+    // Refuse the literal of a message that is too large before the client sends it, by not
+    // sending a continuation request (RFC 3502 section 6.3.11 example A005)
+    server.literalFilters.push((connection, command, line, literalSize) => {
+        const path = getPendingTarget(connection, command, line);
+        const mailbox = path !== false && server.getMailbox(path);
+        if (mailbox && isTooBig(mailbox, literalSize)) {
+            return { command: 'NO', code: 'TOOBIG', text: 'Message exceeds the APPENDLIMIT of the mailbox' };
+        }
+        return false;
+    });
+
+    // RFC 7889 section 3.1: status-att-val =/ "APPENDLIMIT" SP (number / nil)
+    server.allowedStatus.push('APPENDLIMIT');
+    // also used by the STATUS return option of LIST-STATUS (RFC 7889 section 3.2)
+    server.statusHandlers.APPENDLIMIT = (connection, mailbox) => getLimit(mailbox);
+};
+
+function isValidLimit(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}

package/lib/plugins/auth-plain.js

@@ -0,0 +1,94 @@
+'use strict';
+
+/**
+ * @help Adds AUTH=PLAIN capability
+ * @help Supports SALS-IR [RFC4959] as well
+ */
+
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+
+module.exports = function (server) {
+    // Register AUTH=PLAIN capability for non authenticated state
+    server.registerCapability('AUTH=PLAIN', connection => {
+        return connection.state === 'Not Authenticated';
+    });
+
+    // Validates a base64 encoded "authzid NUL authcid NUL passwd" message (RFC 4616) and logs the user in
+    const authenticate = (connection, parsed, data, input) => {
+        const decoded = connection.decodeSaslResponse(input);
+        if (!decoded) {
+            return connection.sendStatus(parsed, data, 'BAD', 'Invalid base64 in SASL response', false, 'AUTHENTICATE PLAIN FAILED');
+        }
+        // RFC 4616 section 2: the message is UTF-8, user names are unicode strings like the keys of `users`
+        let message;
+        try {
+            message = utf8.decode(decoded);
+        } catch {
+            return connection.sendStatus(parsed, data, 'BAD', 'Invalid UTF-8 in SASL PLAIN message', false, 'AUTHENTICATE PLAIN FAILED');
+        }
+        const parts = message.split('\x00');
+        const authzid = parts[0] || '';
+        const username = parts[1] || '';
+        const password = parts[2] || '';
+        const user = connection.server.getUser(username);
+
+        if (parts.length !== 3 || !user || user.password !== password) {
+            // RFC 5530 section 3: unknown user or bad password
+            return connection.sendStatus(parsed, data, 'NO', 'Login failed: authentication failure', 'AUTHENTICATIONFAILED', 'AUTHENTICATE PLAIN FAILED');
+        }
+
+        if (authzid && authzid !== username) {
+            // Acting as another user is not supported, authzid must be empty or the same as authcid. The credentials
+            // were fine, so this is AUTHORIZATIONFAILED (RFC 5530 section 3, RFC 9051 section 7.1)
+            return connection.sendStatus(parsed, data, 'NO', 'Can not act as ' + authzid, 'AUTHORIZATIONFAILED', 'AUTHENTICATE PLAIN FAILED');
+        }
+
+        connection.state = 'Authenticated';
+        connection.username = username;
+        connection.sendStatus(parsed, data, 'OK', 'User logged in', false, 'AUTHENTICATE PLAIN SUCCESS');
+    };
+
+    server.setCommandHandler('AUTHENTICATE PLAIN', (connection, parsed, data, callback) => {
+        // If this is the old style api, send + and wait for password
+        if (!parsed.attributes) {
+            // Temporarily redirect client input to this function
+            connection.inputHandler = function (str) {
+                // Stop listening to any other user input
+                connection.inputHandler = false;
+
+                if (str === '*') {
+                    // Client cancelled the exchange (RFC 3501 section 6.2.2)
+                    return connection.sendStatus(parsed, data, 'BAD', 'Authentication cancelled', false, 'AUTHENTICATE PLAIN FAILED');
+                }
+
+                authenticate(connection, parsed, data, str);
+            };
+
+            // Send an empty continuation request to the client
+            connection.write('+ \r\n');
+        } else if (
+            parsed.attributes.length === 1 &&
+            // second argument must be Base64 string as ATOM
+            parsed.attributes[0].type === 'ATOM'
+        ) {
+            if (!server.capabilities['SASL-IR'] || !server.capabilities['SASL-IR'](connection)) {
+                connection.sendStatus(
+                    parsed,
+                    data,
+                    'BAD',
+                    'SASL-IR must be enabled to send Initial Response with the request',
+                    false,
+                    'AUTHENTICATE PLAIN FAILED'
+                );
+                return callback();
+            }
+
+            authenticate(connection, parsed, data, parsed.attributes[0].value);
+        } else {
+            // Not correct AUTH=PLAIN
+            connection.sendStatus(parsed, data, 'BAD', 'Invalid attributes for AUTHENTICATE PLAIN', false, 'AUTHENTICATE PLAIN FAILED');
+        }
+
+        return callback();
+    });
+};

package/lib/plugins/binary.js

@@ -0,0 +1,256 @@
+'use strict';
+
+const { getMessageData, resolveNode, embeddedMessage, render, parseTree, normalizeLineBreaks, IDENTITY_ENCODINGS } = require('../mimeparser');
+const { applyPartial } = require('../commands/handlers/fetch');
+const { appendError } = require('../commands/append');
+
+/**
+ * @help Adds BINARY [RFC3516] capability
+ *
+ * BINARY: https://www.rfc-editor.org/rfc/rfc3516
+ *
+ * Additional FETCH items:
+ * - BINARY[<part>]<<partial>>, BINARY.PEEK[<part>]<<partial>> and BINARY.SIZE[<part>]
+ *
+ * APPEND (and REPLACE) accept messages as a literal8 (~{n}), binary parts are stored base64 encoded
+ */
+
+// RFC 3516 section 7: section-binary = "[" [section-part] "]", section-part = nz-number *("." nz-number)
+const SECTION_PART = /^[1-9]\d*(?:\.[1-9]\d*)*$/;
+
+// decoded leaf parts, the tree of a message is replaced when its source changes
+const decodedCache = new WeakMap();
+
+/**
+ * Creates an error that fails a command with NO [UNKNOWN-CTE] (RFC 3516 sections 4.3 and 4.4)
+ *
+ * @param {String} message Human readable text
+ * @return {Error}
+ */
+function unknownCte(message) {
+    const err = new Error(message);
+    err.imapResponse = 'NO';
+    err.code = 'UNKNOWN-CTE';
+    return err;
+}
+
+/**
+ * Returns the media type of a tree node, e.g. "text/plain"
+ */
+function mediaType(node) {
+    const contentType = node.parsedHeader['content-type'];
+    return ((contentType && contentType.value) || '').toLowerCase();
+}
+
+/**
+ * Returns the lower case content transfer encoding of a node, 7bit if not set (RFC 2045 section 6.1)
+ */
+function transferEncoding(node) {
+    return (node.parsedHeader['content-transfer-encoding'] || '7bit').toString().trim().toLowerCase();
+}
+
+/**
+ * RFC 9051 section 6.4.5: BINARY applies to leaf body parts only, not to multipart/*, message/rfc822
+ * or message/global parts. IMAP4rev1 describes message/global as a basic part (RFC 3501 body-type-basic)
+ *
+ * @param {Object} node Tree node
+ * @param {Boolean} global message/global is not a leaf, see IMAPConnection#messageGlobal
+ */
+function isLeaf(node, global) {
+    const type = mediaType(node);
+    return !node.boundary && !/^multipart\//.test(type) && type !== 'message/rfc822' && (!global || type !== 'message/global');
+}
+
+/**
+ * Decodes base64 data. RFC 2045 section 6.8: characters outside the base64 alphabet are ignored, and
+ * "=" marks the end of the data
+ *
+ * @param {String} str Encoded data
+ * @return {String} Decoded octets as a binary string
+ */
+function decodeBase64(str) {
+    let data = str.replace(/[^A-Za-z0-9+/=]/g, '').split('=')[0];
+    if (data.length % 4 === 1) {
+        // a single leftover character does not hold a whole octet
+        data = data.slice(0, -1);
+    }
+    return Buffer.from(data, 'base64').toString('binary');
+}
+
+/**
+ * Decodes quoted-printable data (RFC 2045 section 6.7). Trailing white space of a line is removed
+ * (rule 3), a line that ends with "=" continues on the next line (rule 5), and an "=" that is not
+ * followed by two hex digits is kept as it is, as the RFC suggests for robust implementations
+ *
+ * @param {String} str Encoded data with CRLF line breaks
+ * @return {String} Decoded octets as a binary string
+ */
+function decodeQuotedPrintable(str) {
+    return str
+        .replace(/[ \t]+(?=\r\n|$)/g, '')
+        .replace(/=(?:\r\n|$)/g, '')
+        .replace(/=([0-9A-Fa-f]{2})/g, (match, hex) => String.fromCharCode(parseInt(hex, 16)));
+}
+
+/**
+ * Returns the content of a BINARY section with the content transfer encoding removed
+ *
+ * @param {Object} connection IMAP connection
+ * @param {Object} message Message object
+ * @param {Object} query Parsed fetch item
+ * @return {String} Decoded section as a binary string
+ */
+function getDecodedSection(connection, message, query) {
+    const key = query.value.toUpperCase();
+    const section = query.section;
+
+    if (!section) {
+        throw new Error(key + ' requires a section');
+    }
+    if (!section.length) {
+        // the grammar allows BINARY[], but the whole message is not a leaf body part
+        throw new Error(key + '[] is not allowed, BINARY applies to leaf body parts only (RFC 9051 section 6.4.5)');
+    }
+    if (section.length !== 1 || section[0].type !== 'ATOM' || !SECTION_PART.test(section[0].value)) {
+        throw new Error('Invalid ' + key + ' section, expecting a part number (RFC 3516 section 7)');
+    }
+
+    const node = resolveNode(getMessageData(message).tree, section[0].value, connection.messageGlobal);
+    if (!node) {
+        // like BODY[<section>], a part that does not exist is empty
+        return '';
+    }
+    if (!isLeaf(node, connection.messageGlobal)) {
+        throw new Error(key + '[' + section[0].value + '] is not a leaf body part (RFC 9051 section 6.4.5)');
+    }
+
+    if (!decodedCache.has(node)) {
+        decodedCache.set(node, decodeNode(node));
+    }
+    return decodedCache.get(node);
+}
+
+/**
+ * Removes the content transfer encoding of a leaf part
+ *
+ * @param {Object} node Tree node
+ * @return {String} Decoded body as a binary string
+ */
+function decodeNode(node) {
+    const body = render(node, true);
+    const encoding = transferEncoding(node);
+    let decoded;
+    if (IDENTITY_ENCODINGS.includes(encoding)) {
+        decoded = body;
+    } else if (encoding === 'base64') {
+        decoded = decodeBase64(body);
+    } else if (encoding === 'quoted-printable') {
+        decoded = decodeQuotedPrintable(body);
+    } else {
+        throw unknownCte('Unknown Content-Transfer-Encoding ' + JSON.stringify(encoding).replace(/[^\x20-\x7e]/g, '?'));
+    }
+
+    // RFC 3516 section 6: textual sections are sent with CRLF line breaks
+    return /^text\//.test(mediaType(node)) ? normalizeLineBreaks(decoded) : decoded;
+}
+
+/**
+ * BINARY[<section>]<<partial>> (RFC 3516 section 4.2)
+ */
+function fetchBinary(connection, message, query) {
+    // RFC 3516 section 4.2: the range applies to the decoded data
+    const value = applyPartial(getDecodedSection(connection, message, query), query.partial);
+
+    // RFC 3516 section 4.3: data without NUL is sent as a string, a literal8 only when it is needed
+    return {
+        type: value.indexOf('\x00') >= 0 ? 'LITERAL8' : 'LITERAL',
+        value
+    };
+}
+// BINARY sets \Seen like BODY[<section>] does
+fetchBinary.setsSeen = true;
+
+/**
+ * BINARY.SIZE[<section>] (RFC 3516 section 4.2), the size of the decoded section
+ */
+function fetchBinarySize(connection, message, query) {
+    if (query.partial) {
+        // RFC 3516 section 7: "BINARY.SIZE" section-binary, without a partial
+        throw new Error('BINARY.SIZE does not take a partial range');
+    }
+    return getDecodedSection(connection, message, query).length;
+}
+
+/**
+ * Base64 encodes the binary parts of a message that was appended as a literal8, as the IMAP4rev1
+ * part of the protocol can not carry them (RFC 3516 sections 4.4 and 6): parts with the binary
+ * encoding, and parts with an identity encoding that contain NUL octets anyway. Any other NUL octet
+ * (in a header, or in a part with another encoding) can not be stored.
+ *
+ * @param {String} raw Message as a binary string
+ * @return {String} Message to store
+ */
+function storeBinaryMessage(raw) {
+    const tree = parseTree(raw);
+
+    // returns true if the node or anything in it was converted
+    const convert = node => {
+        if (node.childNodes) {
+            // every part is converted, so no short circuit
+            return node.childNodes.map(convert).includes(true);
+        }
+        const message = embeddedMessage(node, true);
+        if (message) {
+            // RFC 2046 section 5.2.1: a message/rfc822 (or message/global) part keeps its identity encoding, its parts are converted
+            if (!convert(message)) {
+                return false;
+            }
+            node.body = render(message);
+            return true;
+        }
+        const encoding = transferEncoding(node);
+        if (!isLeaf(node, true) || !node.body || !(encoding === 'binary' || (IDENTITY_ENCODINGS.includes(encoding) && node.body.indexOf('\x00') >= 0))) {
+            return false;
+        }
+        // RFC 2045 section 6.8: encoded lines are at most 76 characters long
+        node.body = Buffer.from(node.body, 'binary')
+            .toString('base64')
+            .match(/.{1,76}/g)
+            .join('\r\n');
+        node.header = node.header.filter(line => !/^content-transfer-encoding\s*:/i.test(line)).concat('Content-Transfer-Encoding: base64');
+        return true;
+    };
+
+    const result = convert(tree) ? render(tree) : raw;
+    if (result.indexOf('\x00') >= 0) {
+        throw unknownCte('NUL octets are only allowed in the body of a part with the binary, 7bit or 8bit encoding');
+    }
+    return result;
+}
+
+module.exports = function (server) {
+    server.registerCapability('BINARY');
+
+    // RFC 3516 section 7: literal8 and the BINARY fetch items with a section and a partial range
+    server.parserOptions.literal8 = true;
+    server.parserOptions.allowSection.push('BINARY', 'BINARY.PEEK', 'BINARY.SIZE');
+
+    server.fetchHandlers.BINARY = fetchBinary;
+    // the same without setting \Seen
+    server.fetchHandlers['BINARY.PEEK'] = (connection, message, query) => fetchBinary(connection, message, query);
+    server.fetchHandlers['BINARY.SIZE'] = fetchBinarySize;
+
+    // RFC 3516 section 4.4: APPEND (and REPLACE, MULTIAPPEND) take a message as a literal8, the commands
+    // allow it with the literal8: 'BINARY' option
+    server.appendLiteral8 = raw => {
+        try {
+            return storeBinaryMessage(raw);
+        } catch (err) {
+            throw appendError(err.message, err.code);
+        }
+    };
+};
+
+module.exports.decodeBase64 = decodeBase64;
+module.exports.decodeQuotedPrintable = decodeQuotedPrintable;
+module.exports.storeBinaryMessage = storeBinaryMessage;

package/lib/plugins/catenate.js

@@ -0,0 +1,253 @@
+'use strict';
+
+const imapHandler = require('imap-handler');
+const { appendError, badArgument } = require('../commands/append');
+const fetchHandlers = require('../commands/handlers/fetch');
+const { getMessageData, resolveNode } = require('../mimeparser');
+const { encodeMailboxName } = require('../mailbox-name');
+const { isNumber, isNzNumber } = require('../numbers');
+
+/**
+ * @help Adds CATENATE [RFC4469] and URL-PARTIAL [RFC5550] capabilities
+ * @help Only absolute-path URLs are accepted, eg. "/INBOX/;UID=1/;SECTION=1"
+ *
+ * CATENATE: https://www.rfc-editor.org/rfc/rfc4469
+ *
+ * APPEND (and REPLACE) can build a message from literals and IMAP URLs of messages or
+ * message parts on this server. Only absolute-path URLs are accepted, for example
+ * "/INBOX;UIDVALIDITY=1/;UID=2/;SECTION=1.MIME/;PARTIAL=0.100" (RFC 5092). Other URLs,
+ * and URLs that do not resolve, fail with NO [BADURL]. A message larger than the
+ * literal size limit fails with NO [TOOBIG].
+ */
+module.exports = function (server) {
+    server.registerCapability('CATENATE');
+    // RFC 5550 section 5.7.1: ;PARTIAL= is supported in the URLs of CATENATE
+    server.registerCapability('URL-PARTIAL');
+
+    // RFC 4469 section 5: append-data =/ "CATENATE" SP "(" cat-part *(SP cat-part) ")"
+    // cat-part = text-literal / url, text-literal = "TEXT" SP literal, url = "URL" SP astring
+    server.appendDataHandlers.CATENATE = (connection, list) => {
+        if (!Array.isArray(list) || !list.length || list.length % 2) {
+            throw badArgument('CATENATE expects a list of TEXT literals and URLs');
+        }
+
+        const parts = [];
+        for (let i = 0; i < list.length; i += 2) {
+            const label = list[i] && list[i].type === 'ATOM' ? String(list[i].value).toUpperCase() : '';
+            const value = list[i + 1];
+            if (label === 'TEXT' && value && value.type === 'LITERAL') {
+                parts.push({ text: value.value });
+            } else if (label === 'URL' && value && ['ATOM', 'STRING', 'LITERAL'].indexOf(value.type) >= 0) {
+                parts.push({ url: value.value });
+            } else {
+                throw badArgument('Invalid CATENATE part ' + (i / 2 + 1));
+            }
+        }
+
+        // the message is built once the target mailbox is known to exist
+        return () => {
+            const maxSize = connection.getMaxLiteralSize();
+            let raw = '';
+            for (const part of parts) {
+                raw += 'text' in part ? part.text : resolveUrl(connection, part.url);
+                // RFC 4469 section 4.2: TOOBIG for a message over the server's size limit
+                if (raw.length > maxSize) {
+                    throw appendError('Catenated message is too large', 'TOOBIG');
+                }
+            }
+            return raw;
+        };
+    };
+};
+
+// RFC 5092 section 11: bchar (achar / ":" / "@" / "/"), and ";" that starts the URL parameters
+const URL_CHARS = /^[A-Za-z0-9\-._~!$'()*+,&=:@/;%]*$/;
+
+// RFC 5092 section 11: iabsolute-path = "/" imessagepart, where
+// imessagepart = enc-mailbox [uidvalidity] iuid [isection] [ipartial] (URLAUTH is not supported)
+const MESSAGE_PART = /^\/([^;]+?)(?:;UIDVALIDITY=([^/;]*))?\/;UID=([^/;]*)(?:\/;SECTION=([^/;]*))?(?:\/;PARTIAL=([^/;]*))?$/i;
+
+/**
+ * Creates a BADURL error (RFC 4469 section 4.1). url-resp-text is any TEXT-CHAR except "]", so other
+ * octets of an invalid URL are percent-encoded
+ *
+ * @param {String} url URL as the client sent it
+ * @param {String} text Human readable text
+ * @return {Error} Error object
+ */
+function badUrl(url, text) {
+    if (!url) {
+        // url-resp-text can not be empty
+        return appendError(text);
+    }
+    const value = url.replace(/[^\x20-\x5c\x5e-\x7e]/g, chr => '%' + chr.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
+    return appendError(text, 'BADURL', [{ type: 'TEXT', value }]);
+}
+
+/**
+ * Removes "." and ".." segments from a path (RFC 3986 section 5.2.4), as relative IMAP URLs are
+ * resolved by the generic URI rules (RFC 5092 section 7)
+ *
+ * @param {String} path Path that starts with "/"
+ * @return {String} Path without dot segments
+ */
+function removeDotSegments(path) {
+    const segments = path.split('/').slice(1);
+    const output = [];
+    segments.forEach((segment, i) => {
+        const last = i === segments.length - 1;
+        if (segment === '.' || segment === '..') {
+            if (segment === '..') {
+                output.pop();
+            }
+            if (last) {
+                output.push('');
+            }
+            return;
+        }
+        output.push(segment);
+    });
+    return '/' + output.join('/');
+}
+
+/**
+ * Decodes percent-encoded octets
+ *
+ * @param {String} value Percent-encoded string
+ * @return {String} Binary string
+ */
+function percentDecode(value) {
+    return value.replace(/%([0-9a-f]{2})/gi, (match, hex) => String.fromCharCode(parseInt(hex, 16)));
+}
+
+/**
+ * Returns the octets of a message part as BODY.PEEK[<section>] would, or false if the section is
+ * invalid or the part does not exist
+ *
+ * @param {Object} connection IMAPConnection
+ * @param {Object} message Message object
+ * @param {String} section Decoded section-spec
+ * @return {String|Boolean} Section contents
+ */
+function getSection(connection, message, section) {
+    if (!section || !/^[\x20-\x7e]+$/.test(section)) {
+        return false;
+    }
+
+    // reuse the FETCH grammar for section-spec
+    let query;
+    try {
+        const parsed = imapHandler.parser('X FETCH 1 BODY.PEEK[' + section + ']');
+        query = parsed.attributes.length === 2 && !parsed.attributes[1].partial && parsed.attributes[1];
+    } catch {
+        return false;
+    }
+    if (!query || !query.section || !query.section.length || query.section[0].type !== 'ATOM') {
+        return false;
+    }
+
+    // FETCH returns an empty string for a part that does not exist, a URL for it is invalid (RFC 4469 section 4.1)
+    const sectionId = String(query.section[0].value).toUpperCase();
+    const path = (sectionId.match(/^[1-9]\d*(?:\.[1-9]\d*)*/) || [''])[0];
+    if (path) {
+        const node = resolveNode(getMessageData(message).tree, path);
+        const key = sectionId.substr(path.length + 1);
+        // HEADER and TEXT with a part number refer to the message in a message/rfc822 part
+        if (!node || (key && key !== 'MIME' && !node.message)) {
+            return false;
+        }
+    }
+
+    try {
+        return fetchHandlers.BODY(connection, message, { section: query.section }).value;
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Returns the octets an IMAP URL refers to. RFC 4469 section 3: only URLs of messages or message
+ * parts in the current session are supported, relative to "imap://user@server/". RFC 5092 section 7.2
+ * forbids relative-path references, so only absolute-path references ("/" imessagepart) are accepted
+ *
+ * @param {Object} connection IMAPConnection
+ * @param {String} url IMAP URL
+ * @return {String} Binary string
+ */
+function resolveUrl(connection, url) {
+    if (!url) {
+        throw badUrl(url, 'Empty URL does not refer to a message');
+    }
+    if (/^[a-z][a-z0-9+.-]*:/i.test(url) || url.substr(0, 2) === '//') {
+        throw badUrl(url, 'Only absolute-path URLs of this server are supported, e.g. /INBOX/;UID=1');
+    }
+    if (url.charAt(0) !== '/') {
+        throw badUrl(url, 'Relative-path URLs are not allowed (RFC 5092 section 7.2)');
+    }
+    if (!URL_CHARS.test(url) || /%(?![0-9a-f]{2})/i.test(url)) {
+        throw badUrl(url, 'Invalid characters in URL');
+    }
+
+    const match = removeDotSegments(url).match(MESSAGE_PART);
+    if (!match) {
+        throw badUrl(url, 'URL does not refer to a message or a message part');
+    }
+    const [, encMailbox, uidvalidity, uid, encSection, partial] = match;
+
+    // RFC 5092 section 11: uidvalidity and iuid-only are nz-number values (32-bit, RFC 3501 section 9)
+    if ((uidvalidity !== undefined && !isNzNumber(uidvalidity)) || !isNzNumber(uid)) {
+        throw badUrl(url, 'Invalid UIDVALIDITY or UID in URL');
+    }
+
+    // RFC 5092 section 8: mailbox names are percent-encoded UTF-8
+    let name;
+    try {
+        name = new TextDecoder('utf-8', { fatal: true }).decode(Buffer.from(percentDecode(encMailbox), 'binary'));
+    } catch {
+        throw badUrl(url, 'Mailbox name in URL is not valid UTF-8');
+    }
+
+    const mailbox = connection.server.getMailbox(encodeMailboxName(name));
+    if (!mailbox || mailbox.flags.indexOf('\\Noselect') >= 0) {
+        throw badUrl(url, 'Mailbox does not exist');
+    }
+
+    // plugins can refuse to read the mailbox, e.g. ACL without the "r" right
+    for (const check of connection.server.urlAccessChecks) {
+        const refusal = check(connection, mailbox, url);
+        if (refusal) {
+            throw badUrl(url, refusal.text || 'Permission denied');
+        }
+    }
+
+    // RFC 5092 section 5: a stale URL behaves as if the mailbox does not exist
+    if (uidvalidity !== undefined && Number(uidvalidity) !== mailbox.uidvalidity) {
+        throw badUrl(url, 'UIDVALIDITY does not match');
+    }
+
+    const message = mailbox.messages.find(item => item.uid === Number(uid));
+    if (!message) {
+        throw badUrl(url, 'Message does not exist');
+    }
+
+    // RFC 5092 section 6: no section is the whole message, BODY.PEEK[], so \Seen is not set
+    let value = message.raw;
+    if (encSection !== undefined) {
+        value = getSection(connection, message, percentDecode(encSection));
+        if (value === false) {
+            throw badUrl(url, 'Invalid section or the message part does not exist');
+        }
+    }
+
+    if (partial !== undefined) {
+        // RFC 5092 section 11: partial-range = number ["." nz-number], offset and length in octets, both 32-bit
+        // (RFC 3501 section 9)
+        const range = partial.match(/^(\d+)(?:\.(\d+))?$/);
+        if (!range || !isNumber(range[1]) || (range[2] !== undefined && !isNzNumber(range[2]))) {
+            throw badUrl(url, 'Invalid partial range');
+        }
+        value = value.substr(Number(range[1]), range[2] ? Number(range[2]) : undefined);
+    }
+
+    return value;
+}