From 2a24ff933105809fddf882fff2185e5bbbb24f41 Mon Sep 17 00:00:00 2001
From: Andris Reinman <andris@kreata.ee>
Date: Wed, 27 May 2020 11:55:36 +0300
Subject: [PATCH] v1.26.3

---
 imap-core/lib/commands/expunge.js |  9 +++++++++
 imap-core/lib/commands/select.js  | 10 ++++++++++
 imap-core/lib/imap-command.js     |  7 +++++++
 imap-core/lib/imap-connection.js  |  2 ++
 lib/audit-handler.js              |  2 +-
 package.json                      | 14 +++++++-------
 6 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/imap-core/lib/commands/expunge.js b/imap-core/lib/commands/expunge.js
index 57492c27..499cf256 100644
--- a/imap-core/lib/commands/expunge.js
+++ b/imap-core/lib/commands/expunge.js
@@ -19,6 +19,15 @@ module.exports = {
             });
         }
 
+        if (this.session.commandCounters[command.command.toUpperCase().trim()] > 1000) {
+            this.session.selected = this.selected = false;
+            this.state = 'Logout';
+
+            this.clearNotificationListener();
+            this.send(`* BYE Too many ${command.command.toUpperCase().trim()} commands issued, please reconnect`);
+            return setImmediate(() => this.close());
+        }
+
         let logdata = {
             short_message: '[EXPUNGE]',
             _mail_action: 'expunge',
diff --git a/imap-core/lib/commands/select.js b/imap-core/lib/commands/select.js
index 3b89e97d..9e5e112f 100644
--- a/imap-core/lib/commands/select.js
+++ b/imap-core/lib/commands/select.js
@@ -47,6 +47,15 @@ module.exports = {
             });
         }
 
+        if (this.session.commandCounters[command.command.toUpperCase().trim()] > 1000) {
+            this.session.selected = this.selected = false;
+            this.state = 'Logout';
+
+            this.clearNotificationListener();
+            this.send(`* BYE Too many ${command.command.toUpperCase().trim()} commands issued, please reconnect`);
+            return setImmediate(() => this.close());
+        }
+
         let logdata = {
             short_message: '[' + (command.command || '').toString().toUpperCase() + ']',
             _mail_action: (command.command || '').toString().toLowerCase(),
@@ -54,6 +63,7 @@ module.exports = {
             _path: path,
             _sess: this.id
         };
+
         this._server.onOpen(path, this.session, (err, mailboxData) => {
             if (err) {
                 this.session.selected = this.selected = false;
diff --git a/imap-core/lib/imap-command.js b/imap-core/lib/imap-command.js
index c6bd35a6..c7ec6c7c 100644
--- a/imap-core/lib/imap-command.js
+++ b/imap-core/lib/imap-command.js
@@ -249,6 +249,12 @@ class IMAPCommand {
                 });
             }
 
+            if (!this.connection.session.commandCounters[this.command]) {
+                this.connection.session.commandCounters[this.command] = 1;
+            } else {
+                this.connection.session.commandCounters[this.command]++;
+            }
+
             this.connection.logger.debug(
                 {
                     tnx: 'client',
@@ -380,6 +386,7 @@ class IMAPCommand {
     countBadResponses() {
         this.connection._badCount++;
         if (this.connection._badCount > MAX_BAD_COMMANDS) {
+            this.clearNotificationListener();
             this.connection.send('* BYE Too many protocol errors');
             setImmediate(() => this.connection.close(true));
             return false;
diff --git a/imap-core/lib/imap-connection.js b/imap-core/lib/imap-connection.js
index 38a38239..673bf6d9 100644
--- a/imap-core/lib/imap-connection.js
+++ b/imap-core/lib/imap-connection.js
@@ -515,6 +515,8 @@ class IMAPConnection extends EventEmitter {
             getQueryResponse: imapTools.getQueryResponse,
             matchSearchQuery: search.matchSearchQuery,
 
+            commandCounters: {},
+
             isUTF8Enabled: () => this.acceptUTF8Enabled
         };
     }
diff --git a/lib/audit-handler.js b/lib/audit-handler.js
index fad0567b..715879e4 100644
--- a/lib/audit-handler.js
+++ b/lib/audit-handler.js
@@ -175,7 +175,7 @@ class AuditHandler {
     }
 
     async updateDeliveryStatus(queueId, seq, status, info) {
-        await this.gridfs.collection('audit.files').update(
+        await this.gridfs.collection('audit.files').updateMany(
             { 'metadata.info.queueId': queueId },
             {
                 $push: {
diff --git a/package.json b/package.json
index 1b63e45f..aecd9084 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "wildduck",
-    "version": "1.26.1",
+    "version": "1.26.3",
     "description": "IMAP/POP3 server built with Node.js and MongoDB",
     "main": "server.js",
     "scripts": {
@@ -19,18 +19,18 @@
         "apidoc": "0.22.1",
         "chai": "4.2.0",
         "docsify-cli": "4.4.0",
-        "eslint": "7.0.0",
+        "eslint": "7.1.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "6.11.0",
         "grunt": "1.1.0",
         "grunt-cli": "1.3.2",
-        "grunt-eslint": "22.0.0",
+        "grunt-eslint": "23.0.0",
         "grunt-mocha-test": "0.13.3",
         "grunt-shell-spawn": "0.4.0",
         "grunt-wait": "0.3.0",
         "imapflow": "1.0.46",
         "mailparser": "2.7.7",
-        "mocha": "7.1.2",
+        "mocha": "7.2.0",
         "request": "2.88.2",
         "supertest": "4.0.2"
     },
@@ -46,10 +46,10 @@
         "humanname": "0.2.2",
         "iconv-lite": "0.5.1",
         "ioredfour": "1.0.2-ioredis-02",
-        "ioredis": "4.16.3",
+        "ioredis": "4.17.1",
         "isemail": "3.2.0",
         "joi": "14.3.1",
-        "js-yaml": "3.13.1",
+        "js-yaml": "3.14.0",
         "key-fingerprint": "1.1.0",
         "libbase64": "1.2.1",
         "libmime": "4.2.1",
@@ -73,7 +73,7 @@
         "smtp-server": "3.6.0",
         "speakeasy": "2.0.0",
         "u2f": "0.1.3",
-        "uuid": "8.0.0",
+        "uuid": "8.1.0",
         "wild-config": "1.5.1",
         "yargs": "15.3.1"
     },