✨ Enable parenthesized lists in search criteria

This affects search, uid_search, sort, uid_sort, thread, and uid_thread.

Prior to this, sending a parenthesized list in the search criteria for
any of these commands required the use of strings, which are converted
to RawData, which has security implications with untrusted inputs.

With this change, arrays will only be converted into SequenceSet when
_every_ element in the array is a valid SequenceSet input.  Otherwise,
the array will be left alone, which allows us to send parenthesized
lists without using strings and RawData.

For example, some search criteria this change enables:
* `["not", %w[flagged unread]]` converts to `not (flagged unread)`.
* `["return", ["partial", 1..50]]` converts to `return (partial 1:50)`.

Author: nevans

lib/net/imap.rb

@@ -1939,8 +1939,9 @@ def uid_expunge(uid_set)
     # provided as an array or a string.
     #
     #  * When +criteria+ is an array, any array members will be converted into
-    #    a SequenceSet.  _NOTE:_ this means that a parenthesized list cannot be
-    #    sent when +criteria+ is an array.
+    #    SequenceSet if all of their values are integers, ranges of integers,
+    #    <tt>"*"</tt>, +:*+, or a deeply nested array of these types.  All other
+    #    array members will be converted to a parenthesized list.
     #
     #  * When +criteria+ is a string, it will be sent directly to the server
     #    <em>without any validation</em>.  *WARNING:* This is vulnerable to
@@ -1956,8 +1957,8 @@ def uid_expunge(uid_set)
     # Do not use the +charset+ argument when it is embedded in +criteria+.
     # For example:
     #
-    #    imap.search("CHARSET UTF-8 OR UNSEEN FLAGGED")
-    #    imap.search(%w[CHARSET UTF-8 OR UNSEEN FLAGGED])
+    #    imap.search("CHARSET UTF-8 (OR UNSEEN FLAGGED)")
+    #    imap.search(["CHARSET", "UTF-8", %w(OR UNSEEN FLAGGED)])
     #
     # Related: #uid_search
     #
@@ -2963,17 +2964,10 @@ def enforce_logindisabled?
     end
 
     def search_internal(cmd, keys, charset)
-      if keys.instance_of?(String)
-        keys = [RawData.new(keys)]
-      else
-        normalize_searching_criteria(keys)
-      end
+      keys = normalize_searching_criteria(keys)
+      args = charset ? ["CHARSET", charset, *keys] : keys
       synchronize do
-        if charset
-          send_command(cmd, "CHARSET", charset, *keys)
-        else
-          send_command(cmd, *keys)
-        end
+        send_command(cmd, *args)
         clear_responses("SEARCH").last || []
       end
     end
@@ -3020,38 +3014,24 @@ def copy_internal(cmd, set, mailbox)
     end
 
     def sort_internal(cmd, sort_keys, search_keys, charset)
-      if search_keys.instance_of?(String)
-        search_keys = [RawData.new(search_keys)]
-      else
-        normalize_searching_criteria(search_keys)
-      end
+      search_keys = normalize_searching_criteria(search_keys)
       synchronize do
         send_command(cmd, sort_keys, charset, *search_keys)
         clear_responses("SORT").last || []
       end
     end
 
     def thread_internal(cmd, algorithm, search_keys, charset)
-      if search_keys.instance_of?(String)
-        search_keys = [RawData.new(search_keys)]
-      else
-        normalize_searching_criteria(search_keys)
-      end
+      search_keys = normalize_searching_criteria(search_keys)
       synchronize do
         send_command(cmd, algorithm, charset, *search_keys)
         clear_responses("THREAD").last || []
       end
     end
 
-    def normalize_searching_criteria(keys)
-      keys.collect! do |i|
-        case i
-        when -1, Range, Array
-          SequenceSet.new(i)
-        else
-          i
-        end
-      end
+    def normalize_searching_criteria(criteria)
+      return RawData.new(criteria) if criteria.is_a?(String)
+      criteria.map {|i| SequenceSet::Coercible[i] ? SequenceSet[i] : i }
     end
 
     def build_ssl_ctx(ssl)

lib/net/imap/sequence_set.rb

@@ -276,16 +276,29 @@ class SequenceSet
       # The largest possible non-zero unsigned 32-bit integer
       UINT32_MAX = 2**32 - 1
 
+      REGEXP = ResponseParser::Patterns::SEQUENCE_SET_STR
+      private_constant :REGEXP
+
       # represents "*" internally, to simplify sorting (etc)
       STAR_INT  = UINT32_MAX + 1
       private_constant :STAR_INT
 
       # valid inputs for "*"
       STARS     = [:*, ?*, -1].freeze
-      private_constant :STAR_INT, :STARS
+      private_constant :STARS
 
-      COERCIBLE = ->{ _1.respond_to? :to_sequence_set }
-      private_constant :COERCIBLE
+      # Matches objects which should be implicitly converted into SequenceSet
+      # objects.  Note that the inputs are not validated, and some valid inputs
+      # (Enumerable other than Array or Set) will be rejected.
+      Coercible = ->(obj) do
+        case obj
+        when SequenceSet            then true
+        when Integer, Range, *STARS then true
+        when String                 then REGEXP.match?(obj.b)
+        when Array, Set             then obj.all?(Coercible) && !obj.empty?
+        else                             obj.respond_to?(:to_sequence_set)
+        end
+      end
 
       class << self
 

test/net/imap/test_imap.rb

@@ -1206,16 +1206,31 @@ def test_unselect
       end
 
       server.on "SEARCH", &search_resp
-      assert_equal search_result, imap.search(["subject", "hello",
-                                               [1..5, 8, 10..-1]])
+      server.on "UID SEARCH", &search_resp
+
+      assert_equal search_result, imap.search(
+        ["subject", "hello", [1..5, 8, 10..-1]]
+      )
       cmd = server.commands.pop
       assert_equal ["SEARCH", "subject hello 1:5,8,10:*"], [cmd.name, cmd.args]
 
-      server.on "UID SEARCH", &search_resp
-      assert_equal search_result, imap.uid_search(["subject", "hello",
-                                                   [1..22, 30..-1]])
+      assert_equal search_result, imap.uid_search(
+        ["subject", "hello", [1..22, 30..-1]]
+      )
       cmd = server.commands.pop
       assert_equal ["UID SEARCH", "subject hello 1:22,30:*"], [cmd.name, cmd.args]
+
+      assert_equal search_result, imap.search(
+        "RETURN (COUNT) NOT (FLAGGED (OR SEEN ANSWERED))"
+      )
+      cmd = server.commands.pop
+      assert_equal "RETURN (COUNT) NOT (FLAGGED (OR SEEN ANSWERED))", cmd.args
+
+      assert_equal search_result, imap.search([
+        "RETURN", %w(MIN MAX COUNT), "NOT", ["FLAGGED", %w(OR SEEN ANSWERED)]
+      ])
+      cmd = server.commands.pop
+      assert_equal "RETURN (MIN MAX COUNT) NOT (FLAGGED (OR SEEN ANSWERED))", cmd.args
     end
   end