From f2cdfcf33ad2bd3bd1acdba0326281089f53c5b1 Mon Sep 17 00:00:00 2001 From: isaacs Date: Wed, 26 Feb 2020 14:20:02 -0800 Subject: [PATCH 1/3] fix: Do not pass scp-style URLs to the WhatWG url.URL Fix #60 (for the legacy branch) --- index.js | 19 ++++++++++++++++--- package.json | 2 +- test/basic.js | 2 ++ 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/index.js b/index.js index 301f5d4..b57880c 100644 --- a/index.js +++ b/index.js @@ -109,9 +109,22 @@ function parseGitUrl (giturl) { if (!matched) { var legacy = url.parse(giturl) if (legacy.auth) { - var whatwg = new url.URL(giturl) - legacy.auth = whatwg.username || '' - if (whatwg.password) legacy.auth += ':' + whatwg.password + // git urls can be in the form of scp-style/ssh-connect strings, like + // git+ssh://user@host.com:some/path, which the legacy url parser + // supports, but WhatWG url.URL class does not. However, the legacy + // parser de-urlencodes the username and password, so something like + // https://user%3An%40me:p%40ss%3Aword@x.com/ becomes + // https://user:n@me:p@ss:word@x.com/ which is all kinds of wrong. + // Pull off just the auth and host, so we dont' get the confusing + // scp-style URL, then pass that to the WhatWG parser to get the + // auth properly escaped. + const authmatch = giturl.match(/[^@]+@[^:/]+/) + /* istanbul ignore else - this should be impossible */ + if (authmatch) { + var whatwg = new url.URL(authmatch[0]) + legacy.auth = whatwg.username || '' + if (whatwg.password) legacy.auth += ':' + whatwg.password + } } return legacy } diff --git a/package.json b/package.json index 5afd1a5..2f70777 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "scripts": { "prerelease": "npm t", "postrelease": "npm publish --tag=ancient-legacy-fixes && git push --follow-tags", - "pretest": "standard", + "posttest": "standard", "release": "standard-version -s", "test:coverage": "tap --coverage-report=html -J --100 --no-esm test/*.js", "test": "tap -J --100 --no-esm test/*.js" diff --git a/test/basic.js b/test/basic.js index 76a8d6f..e41b637 100644 --- a/test/basic.js +++ b/test/basic.js @@ -37,6 +37,8 @@ test('basic', function (t) { t.is(HostedGit.fromUrl('github.com/abc/def/'), undefined, 'forgot the protocol') t.is(HostedGit.fromUrl('completely-invalid'), undefined, 'not a url is not hosted') + t.is(HostedGit.fromUrl('git+ssh://git@git.unlucky.com:RND/electron-tools/some-tool#2.0.1'), undefined, 'properly ignores non-hosted scp style urls') + t.is(HostedGit.fromUrl('http://github.com/foo/bar').toString(), 'git+ssh://git@github.com/foo/bar.git', 'github http protocol use git+ssh urls') t.end() }) From 2d0bb6615ecb8f9ef1019bc0737aab7f6449641f Mon Sep 17 00:00:00 2001 From: isaacs Date: Wed, 26 Feb 2020 14:30:20 -0800 Subject: [PATCH 2/3] fix: Do not attempt to use url.URL when unavailable Fix #61 This should not be ported to the latest branch, as Node.js v6 support was dropped there anyway. PR-URL: https://github.com/npm/hosted-git-info/pull/62 Credit: @isaacs Close: #62 Reviewed-by: @isaacs --- index.js | 4 +++- test/auth.js | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index b57880c..08fa329 100644 --- a/index.js +++ b/index.js @@ -108,7 +108,9 @@ function parseGitUrl (giturl) { var matched = giturl.match(/^([^@]+)@([^:/]+):[/]?((?:[^/]+[/])?[^/]+?)(?:[.]git)?(#.*)?$/) if (!matched) { var legacy = url.parse(giturl) - if (legacy.auth) { + // If we don't have url.URL, then sorry, this is just not fixable. + // This affects Node <= 6.12. + if (legacy.auth && typeof url.URL === 'function') { // git urls can be in the form of scp-style/ssh-connect strings, like // git+ssh://user@host.com:some/path, which the legacy url parser // supports, but WhatWG url.URL class does not. However, the legacy diff --git a/test/auth.js b/test/auth.js index 0e5c752..8393ab8 100644 --- a/test/auth.js +++ b/test/auth.js @@ -16,3 +16,9 @@ tap.equal(parsedUrl.hostname, 'github.com') // For full backwards-compatibility; support auth where only username or only password is provided tap.equal(HostedGitInfo.fromUrl('https://user%3An%40me@github.com/npm/hosted-git-info.git').auth, 'user%3An%40me') tap.equal(HostedGitInfo.fromUrl('https://:p%40ss%3Aword@github.com/npm/hosted-git-info.git').auth, ':p%40ss%3Aword') + +// don't try to url.URL parse it if url.URL is not available +// ie, node <6.13. This is broken, but at least it doesn't throw. +url.URL = null +var parsedInfoNoURL = HostedGitInfo.fromUrl('https://user%3An%40me:p%40ss%3Aword@github.com/npm/xyz.git') +tap.equal(parsedInfoNoURL.auth, 'user:n@me:p@ss:word') From 7440afa859162051c191e55d8ecfaf69a193b026 Mon Sep 17 00:00:00 2001 From: isaacs Date: Wed, 26 Feb 2020 15:42:34 -0800 Subject: [PATCH 3/3] chore(release): 2.8.7 --- CHANGELOG.md | 11 +++++++++++ package-lock.json | 2 +- package.json | 2 +- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cbf724b..21fe13c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines. + +## [2.8.7](https://github.com/npm/hosted-git-info/compare/v2.8.6...v2.8.7) (2020-02-26) + + +### Bug Fixes + +* Do not attempt to use url.URL when unavailable ([2d0bb66](https://github.com/npm/hosted-git-info/commit/2d0bb66)), closes [#61](https://github.com/npm/hosted-git-info/issues/61) [#62](https://github.com/npm/hosted-git-info/issues/62) +* Do not pass scp-style URLs to the WhatWG url.URL ([f2cdfcf](https://github.com/npm/hosted-git-info/commit/f2cdfcf)), closes [#60](https://github.com/npm/hosted-git-info/issues/60) + + + ## [2.8.6](https://github.com/npm/hosted-git-info/compare/v2.8.5...v2.8.6) (2020-02-25) diff --git a/package-lock.json b/package-lock.json index ccbecce..1c629fa 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "hosted-git-info", - "version": "2.8.6", + "version": "2.8.7", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 2f70777..4594c3e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "hosted-git-info", - "version": "2.8.6", + "version": "2.8.7", "description": "Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab", "main": "index.js", "repository": {