Guard POP3 Command

POP3 command-line validator (RFC 1939 Post Office Protocol — Version 3). Gates every command verb the framework's POP3 listener accepts from peers — USER / PASS / APOP / AUTH / STLS / CAPA / STAT / LIST / RETR / DELE / NOOP / RSET / TOP / UIDL / QUIT.

POP3 is a simple line-oriented text protocol. Each command is a single CRLF-terminated line; responses are +OK ... or -ERR ... single-line or multi-line (terminated by . on a line of its own).

## Smuggling defense — bare-CR / bare-LF refusal

Same wire-protocol concern as SMTP / IMAP. POP3's . end-of-multiline terminator is matched on canonical CRLF only; bare-LF dot-terminators are refused. Command lines themselves must be CRLF-terminated and contain no bare CR or LF.

## STLS injection

RFC 2595 STLS upgrade (POP3's equivalent of STARTTLS) is subject to the same pre-handshake command-buffer injection class as SMTP / IMAP STARTTLS (CVE-2021-38371 Exim, CVE-2021-33515 Dovecot). This guard refuses trailing payload on the STLS line; the listener's STLS handler is responsible for draining the pre-handshake buffer.

## Per-verb shape

RFC 1939 §6 and RFC 2449 §5 define the verbs:

- USER — single argument - PASS — single argument; refuse in CAPA (operator must rely on TLS confidentiality) - APOP — RFC 1939 §7 challenge-response (legacy) - AUTH [] — RFC 5034 SASL framework (PLAIN / CRAM-MD5 / SCRAM-SHA-256 / EXTERNAL) - STLS — RFC 2595 §4 TLS upgrade - CAPA — RFC 2449 §5 capability discovery - STAT — no args - LIST [msg] — optional msg-number argument - RETR — single message-number argument - DELE — single message-number argument - NOOP — no args - RSET — no args - TOP — RFC 2449 §5 — message + header-line count - UIDL [msg] — RFC 1939 §7 — optional msg arg - QUIT — no args

## Caps

- Command line capped at 255 bytes per RFC 2449 §4 (response lines are 512 octets including CRLF; the command-line cap is even tighter). - Username + password capped at 40 octets each per RFC 1939 §3 (longer values accepted under permissive but the wire is interpretation-defined). - Message-number capped at 10-decimal-digit positive integer.

Throws GuardPop3CommandError on every refusal.

b.guardPop3Command.validate(line, opts?) #

{
  profile:   "strict" | "balanced" | "permissive",
  posture:   "hipaa" | "pci-dss" | "gdpr" | "soc2",
  tls:       boolean,    // when false + verb is USER/PASS under
                           strict, refuse with `guard-pop3-command/
                           cleartext-auth` (TLS required for credentials)
}

Validate a single POP3 command line (without its CRLF terminator). Returns { verb, args } on success; throws GuardPop3CommandError on refusal.

var parsed = b.guardPop3Command.validate("USER alice", { tls: true });
// → { verb: "USER", args: ["alice"] }

var pending = b.guardPop3Command.validate("RETR 12");
// → { verb: "RETR", args: ["12"] }

b.guardPop3Command.compliancePosture(name) #

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardPop3Command.compliancePosture("hipaa");                   // → "strict"
b.guardPop3Command.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.