Commitf2cdfcf

committed

fix: Do not pass scp-style URLs to the WhatWG url.URL

Fix#60 (for the legacy branch)

1 parente1b83df commitf2cdfcfCopy full SHA for f2cdfcf

File tree

+19

-4

lines changed

+19

-4

lines changed

Lines changed: 16 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -109,9 +109,22 @@ function parseGitUrl (giturl) {`
`109`	`109`	`if(!matched){`
`110`	`110`	`varlegacy=url.parse(giturl)`
`111`	`111`	`if(legacy.auth){`
`112`		`-varwhatwg=newurl.URL(giturl)`
`113`		`-legacy.auth=whatwg.username\|\|''`
`114`		`-if(whatwg.password)legacy.auth+=':'+whatwg.password`
	`112`	`+// git urls can be in the form of scp-style/ssh-connect strings, like`
	`113`	`+// git+ssh://user@host.com:some/path, which the legacy url parser`
	`114`	`+// supports, but WhatWG url.URL class does not. However, the legacy`
	`115`	`+// parser de-urlencodes the username and password, so something like`
	`116`	`+// https://user%3An%40me:p%40ss%3Aword@x.com/ becomes`
	`117`	`+// https://user:n@me:p@ss:word@x.com/ which is all kinds of wrong.`
	`118`	`+// Pull off just the auth and host, so we dont' get the confusing`
	`119`	`+// scp-style URL, then pass that to the WhatWG parser to get the`
	`120`	`+// auth properly escaped.`
	`121`	`+constauthmatch=giturl.match(/[^@]+@[^:/]+/)`
	`122`	`+/* istanbul ignore else - this should be impossible */`
	`123`	`+if(authmatch){`
	`124`	`+varwhatwg=newurl.URL(authmatch[0])`
	`125`	`+legacy.auth=whatwg.username\|\|''`
	`126`	`+if(whatwg.password)legacy.auth+=':'+whatwg.password`
	`127`	`+}`
`115`	`128`	`}`
`116`	`129`	`returnlegacy`
`117`	`130`	`}`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@`
`22`	`22`	`"scripts": {`
`23`	`23`	`"prerelease":"npm t",`
`24`	`24`	`"postrelease":"npm publish --tag=ancient-legacy-fixes && git push --follow-tags",`
`25`		`-"pretest":"standard",`
	`25`	`+"posttest":"standard",`
`26`	`26`	`"release":"standard-version -s",`
`27`	`27`	`"test:coverage":"tap --coverage-report=html -J --100 --no-esm test/*.js",`
`28`	`28`	`"test":"tap -J --100 --no-esm test/*.js"`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,8 @@ test('basic', function (t) {`
`37`	`37`	`t.is(HostedGit.fromUrl('github.com/abc/def/'),undefined,'forgot the protocol')`
`38`	`38`	`t.is(HostedGit.fromUrl('completely-invalid'),undefined,'not a url is not hosted')`
`39`	`39`
	`40`	`+t.is(HostedGit.fromUrl('git+ssh://git@git.unlucky.com:RND/electron-tools/some-tool#2.0.1'),undefined,'properly ignores non-hosted scp style urls')`
	`41`	`+`
`40`	`42`	`t.is(HostedGit.fromUrl('http://github.com/foo/bar').toString(),'git+ssh://git@github.com/foo/bar.git','github http protocol use git+ssh urls')`
`41`	`43`	`t.end()`
`42`	`44`	`})`

Comments

(0)