Quote non-ASCII names and do not parenthesize FETCH macros

Non-ASCII mailbox names are only allowed in a quoted string or
a literal, never in an atom (RFC 6855).

"ALL", "FULL" and "FAST" are macros, not data item names;
they cannot be enclosed in parentheses.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: serhiy-storchaka

Lib/imaplib.py

@@ -130,8 +130,8 @@
 _Literal = br'.*{(?P<size>\d+)}$'
 _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
 _control_chars = re.compile(b'[\x00-\x1F\x7F]')
-_non_astring_char = re.compile(br'[(){ \x00-\x1f\x7f%*\\"]')
-_non_list_char = re.compile(br'[(){ \x00-\x1f\x7f\\"]')
+_non_astring_char = re.compile(br'[(){ \x00-\x1f\x7f-\xff%*\\"]')
+_non_list_char = re.compile(br'[(){ \x00-\x1f\x7f-\xff\\"]')
 _quoted = re.compile(br'"(?:[^"\\]|\\.)*+"')
 
 
@@ -651,7 +651,7 @@ def fetch(self, message_set, message_parts):
         """
         name = 'FETCH'
         typ, dat = self._simple_command(name, self._sequence_set(message_set),
-                                        self._set_quote(message_parts))
+                                        self._fetch_parts(message_parts))
         return self._untagged_response(typ, dat, name)
 
 
@@ -1036,7 +1036,7 @@ def uid(self, command, *args):
         elif command == 'FETCH':
             message_set, message_parts = args
             args = (self._sequence_set(message_set),
-                    self._set_quote(message_parts))
+                    self._fetch_parts(message_parts))
         elif command == 'STORE':
             message_set, op, flags = args
             args = (self._sequence_set(message_set), op,
@@ -1442,6 +1442,13 @@ def _set_quote(self, arg):
             return arg
         return '(' + arg + ')'
 
+    def _fetch_parts(self, arg):
+        # "ALL", "FULL" and "FAST" are macros, not data item names;
+        # they cannot be enclosed in parentheses.
+        if arg.upper() in ('ALL', 'FULL', 'FAST'):
+            return arg
+        return self._set_quote(arg)
+
     def _quote(self, arg):
         if isinstance(arg, str):
             arg = bytes(arg, self._encoding)

Lib/test/test_imaplib.py

@@ -190,6 +190,11 @@ def test_astring(self):
         self.assertEqual(m._astring('"a" SELECT evil "'),
                          b'"\\"a\\" SELECT evil \\""')
         self.assertEqual(m._astring('"'), b'"\\""')
+        # Non-ASCII names are only allowed in a quoted string or a
+        # literal, never in an atom (RFC 6855).
+        m._encoding = 'utf-8'
+        self.assertEqual(m._astring('Entwürfe'), '"Entwürfe"'.encode())
+        self.assertEqual(m._astring(b'Entw\xc3\xbcrfe'), b'"Entw\xc3\xbcrfe"')
 
     def test_astring_idempotent(self):
         # Quoting an already quoted argument should not change it, so that
@@ -198,7 +203,7 @@ def test_astring_idempotent(self):
         m._encoding = 'ascii'
         for arg in ['INBOX', 'New folder', 'a"b', 'a\\b', '', '*', '%',
                     '"New folder"', '""', '"a\\b"', '"a" SELECT evil "',
-                    '"', 'a\tb', 'a\rb', '\x7f', '(a)']:
+                    '"', 'a\tb', 'a\rb', '\x7f', '(a)', b'Entw\xc3\xbcrfe']:
             with self.subTest(arg=arg):
                 once = m._astring(arg)
                 self.assertEqual(m._astring(once), once)
@@ -215,6 +220,11 @@ def test_list_mailbox(self):
         # But spaces still require quoting.
         self.assertEqual(m._list_mailbox('New folder'), b'"New folder"')
         self.assertEqual(m._list_mailbox('"New folder"'), b'"New folder"')
+        # As do non-ASCII names; wildcards keep their meaning inside a
+        # quoted string.
+        m._encoding = 'utf-8'
+        self.assertEqual(m._list_mailbox('Entwürfe/%'),
+                         '"Entwürfe/%"'.encode())
 
 
 if ssl:
@@ -578,6 +588,26 @@ def cmd_AUTHENTICATE(self, tag, args):
         with self.assertRaisesRegex(imaplib.IMAP4.error, 'charset.*UTF8'):
             client.search('foo', 'bar')
 
+    def test_utf8_mailbox_name(self):
+        class UTF8Server(SimpleIMAPHandler):
+            capabilities = 'AUTH ENABLE UTF8=ACCEPT'
+            def cmd_ENABLE(self, tag, args):
+                self._send_tagged(tag, 'OK', 'ENABLE successful')
+            def cmd_AUTHENTICATE(self, tag, args):
+                self._send_textline('+')
+                self.server.response = yield
+                self._send_tagged(tag, 'OK', 'FAKEAUTH successful')
+        client, server = self._setup(UTF8Server)
+        typ, _ = client.authenticate('MYAUTH', lambda x: b'fake')
+        self.assertEqual(typ, 'OK')
+        typ, _ = client.enable('UTF8=ACCEPT')
+        self.assertEqual(typ, 'OK')
+        # A non-ASCII mailbox name is only allowed in a quoted string
+        # or a literal, never in an atom (RFC 6855).
+        typ, _ = client.select('Entwürfe')
+        self.assertEqual(typ, 'OK')
+        self.assertEqual(server.is_selected, ['"Entwürfe"'])
+
     def test_bad_auth_name(self):
         class MyServer(SimpleIMAPHandler):
             def cmd_AUTHENTICATE(self, tag, args):
@@ -1208,6 +1238,14 @@ def cmd_FETCH(self, tag, args):
         self.assertEqual(typ, 'OK')
         self.assertEqual(server.args, ['2:4', '(FLAGS)'])
 
+        # But the macros are not, as they are not data item names.
+        typ, data = client.fetch('2:4', 'ALL')
+        self.assertEqual(typ, 'OK')
+        self.assertEqual(server.args, ['2:4', 'ALL'])
+        typ, data = client.fetch('2:4', 'fast')
+        self.assertEqual(typ, 'OK')
+        self.assertEqual(server.args, ['2:4', 'fast'])
+
     def test_uid_fetch(self):
         client, server = self._setup(make_simple_handler('UID', [
             r'* 23 FETCH (FLAGS (\Seen) UID 4827313)',
@@ -1229,6 +1267,10 @@ def test_uid_fetch(self):
         self.assertEqual(typ, 'OK')
         self.assertEqual(server.args, ['FETCH', '4827313:4828442', '(FLAGS)'])
 
+        typ, data = client.uid('fetch', '4827313:4828442', 'ALL')
+        self.assertEqual(typ, 'OK')
+        self.assertEqual(server.args, ['FETCH', '4827313:4828442', 'ALL'])
+
     def test_partial(self):
         client, server = self._setup(make_simple_handler('PARTIAL',
             ['* 1 FETCH (RFC822.TEXT<0.10> "0123456789")']))