@node-red/registry 4.1.8 → 4.1.10

package/lib/externalModules.js

@@ -12,11 +12,13 @@ const log = require("@node-red/util").log;
 const hooks = require("@node-red/util").hooks;
 const url = require("url");
 const { createRequire } = require("module");
+const validateNpmPackageName = require("validate-npm-package-name");
 
 const BUILTIN_MODULES = require('module').builtinModules;
 
-// TODO: outsource running npm to a plugin
-const NPM_COMMAND = (process.platform === "win32") ? "npm.cmd" : "npm";
+const npmPackageJson = require.resolve('npm/package.json')
+const npmRoot = path.dirname(npmPackageJson);
+const npmCli = path.join(npmRoot, 'bin', 'npm-cli.js');
 
 let registeredTypes = {};
 let subflowTypes = {};
@@ -246,6 +248,11 @@ async function installModule(moduleDetails) {
             e.code = "install_not_allowed";
             throw e;
         }
+        if (!validateNpmPackageName(moduleDetails.module).validForOldPackages) {
+            const e = new Error("Invalid module name");
+            e.code = "install_not_allowed";
+            throw e;
+        }
         if (moduleDetails.version) {
             installSpec = installSpec+"@"+moduleDetails.version;
         }
@@ -265,9 +272,10 @@ async function installModule(moduleDetails) {
             // - run install
             if (result !== false) {
                 let extraArgs = triggerPayload.args || [];
-                let args = ['install', ...extraArgs, installSpec]
-                log.trace(NPM_COMMAND + JSON.stringify(args));
-                return exec.run(NPM_COMMAND, args, { cwd: installDir, shell: true },true)
+                let args = [npmCli, 'install', ...extraArgs, '--', installSpec]
+                log.trace(`${process.execPath} ${npmCli} ${JSON.stringify(args)}`);
+                console.log('HIT EM ONE')
+                return exec.run(process.execPath, args, { cwd: installDir },true)
             } else {
                 log.trace("skipping npm install");
             }

package/lib/installer.js

@@ -29,12 +29,16 @@ const child_process = require('child_process');
 const plugins = require("./plugins");
 
 const isWindows = process.platform === 'win32'
-const npmCommand =  isWindows ? 'npm.cmd' : 'npm';
+
+const npmPackageJson = require.resolve('npm/package.json')
+const npmRoot = path.dirname(npmPackageJson);
+const npmCli = path.join(npmRoot, 'bin', 'npm-cli.js');
+
+const validateNpmPackageName = require("validate-npm-package-name");
 
 let installerEnabled = false;
 let settings;
 
-const moduleRe = /^(@[^/@]+?[/])?[^/@]+?$/;
 const slashRe = isWindows ? /\\|[/]/ : /[/]/;
 const pkgurlRe = /^(https?|git(|\+https?|\+ssh|\+file)):\/\//;
 const localtgzRe = /^([a-zA-Z]:|\/).+tgz$/;
@@ -143,8 +147,7 @@ async function installModule(module,version,url) {
         var isExisting = false;
         if (url) {
             if (pkgurlRe.test(url) || localtgzRe.test(url)) {
-                // Git remote url or Tarball url - check the valid package url
-                installName = localtgzRe.test(url) && slashRe.test(url) ? `"${url}"` : url;
+                installName = url;
                 isRegistryPackage = false;
             } else {
                 log.warn(log._("server.install.install-failed-url",{name:module,url:url}));
@@ -152,8 +155,8 @@ async function installModule(module,version,url) {
                 e.code = "invalid_module_url";
                 throw e;
             }
-        } else if (moduleRe.test(module)) {
-            // Simple module name - assume it can be npm installed
+        } else if (validateNpmPackageName(module).validForOldPackages) {
+            // A valid npm module name
             if (version) {
                 installName += "@"+version;
             }
@@ -169,9 +172,12 @@ async function installModule(module,version,url) {
             e.code = "invalid_module_name";
             throw e;
         }
+
         if (!installAllAllowed) {
             let installVersion = version;
-            if (installVersionRestricted && isRegistryPackage) {
+            if (isRegistryPackage) {
+                // For an registry module, this will validate the version exists before trying to install it
+                // It will throw an error if the version doesn't exist.
                 installVersion = await getModuleVersionFromNPM(module, version);
             }
 
@@ -228,9 +234,9 @@ async function installModule(module,version,url) {
             // - run install
             if (result !== false) {
                 let extraArgs = triggerPayload.args || [];
-                let args = ['install', ...extraArgs, installName]
-                log.trace(npmCommand + JSON.stringify(args));
-                return exec.run(npmCommand,args,{ cwd: installDir, shell: true }, true)
+                let args = [npmCli, 'install', ...extraArgs, '--', installName]
+                log.trace(`${process.execPath} ${npmCli} ${JSON.stringify(args)}`);
+                return exec.run(process.execPath, args, { cwd: installDir }, true)
             } else {
                 log.trace("skipping npm install");
             }
@@ -265,7 +271,7 @@ async function installModule(module,version,url) {
                 log.warn("------------------------------------------");
                 e = new Error(log._("server.install.install-failed")+": "+err.toString());
                 if (err.hook === "postInstall") {
-                    return exec.run(npmCommand,["remove",module],{ cwd: installDir, shell: true }, false).finally(() => {
+                    return exec.run(process.execPath, [npmCli, "remove", module],{ cwd: installDir }, false).finally(() => {
                         throw e;
                     })
                 }
@@ -370,7 +376,7 @@ async function getModuleVersionFromNPM(module, version) {
     
 
     return new Promise((resolve, reject) => {
-        child_process.execFile(`${npmCommand} info --json ${installName}`, { shell: true },function(err,stdout,stderr) {
+        child_process.execFile(process.execPath, [npmCli, 'info', '--json', '--', installName], function(err,stdout,stderr) {
             try {
                 if (!stdout) {
                     log.warn(log._("server.install.install-failed-not-found",{name:module}));
@@ -381,6 +387,7 @@ async function getModuleVersionFromNPM(module, version) {
                 }
                 const response = JSON.parse(stdout);
                 if (response.error) {
+                    console.log(response)
                     if (response.error.code === "E404") {
                         log.warn(log._("server.install.install-failed-not-found",{name:module}));
                         e = new Error("Module not found");
@@ -495,9 +502,14 @@ async function getTarballModuleInfo(tarball) {
 }
 
 function uninstallModule(module) {
+    // This function is called when the admin api is called to remove a module.
+    // A check in nodes.js#removeModule verifies the module being removed is already in the registry
+    // as a user module. As such, we can have confidence that the `module` passed here is 
+    // a valid and recognised module name. But lets not rely 100% on that.
     activePromise = activePromise.then(() => {
         return new Promise((resolve,reject) => {
-            if (/[\s;]/.test(module)) {
+            // Ensure its a valid package name and nothing has slipped through other checks
+            if (!validateNpmPackageName(module).validForOldPackages) {
                 reject(new Error(log._("server.install.invalid")));
                 return;
             }
@@ -527,9 +539,9 @@ function uninstallModule(module) {
                 // - run uninstall
                 if (result !== false) {
                     let extraArgs = triggerPayload.args || [];
-                    let args = ['remove', ...extraArgs, module]
-                    log.trace(npmCommand + JSON.stringify(args));
-                    return exec.run(npmCommand,args,{ cwd: installDir, shell: true }, true)
+                    let args = [npmCli, 'remove', ...extraArgs, '--', module]
+                    log.trace(`${process.execPath} ${npmCli} ${JSON.stringify(args)}`);
+                    return exec.run(process.execPath, args, { cwd: installDir }, true)
                 } else {
                     log.trace("skipping npm uninstall");
                 }
@@ -596,7 +608,7 @@ async function checkPrereq() {
         installerEnabled = false;
     } else {
         return new Promise(resolve => {
-            child_process.execFile(`${npmCommand} -v`,{ shell: true },function(err,stdout) {
+            child_process.execFile(process.execPath, [npmCli, '-v'], function(err,stdout) {
                 if (err) {
                     log.info(log._("server.palette-editor.npm-not-found"));
                     installerEnabled = false;

package/lib/registry.js

@@ -551,6 +551,9 @@ function getNodeConstructor(type) {
 function clear() {
     nodeConfigCache = {};
     moduleConfigs = {};
+    moduleNodes = {};
+    icon_paths = {};
+    iconCache = {};
     nodeList = [];
     nodeConstructors = {};
     nodeOptions = {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@node-red/registry",
-    "version": "4.1.8",
+    "version": "4.1.10",
     "license": "Apache-2.0",
     "main": "./lib/index.js",
     "repository": {
@@ -16,11 +16,13 @@
         }
     ],
     "dependencies": {
-        "@node-red/util": "4.1.8",
+        "@node-red/util": "4.1.10",
         "clone": "2.1.2",
         "fs-extra": "11.3.0",
+        "npm": "^10.9.8",
         "semver": "7.7.4",
         "tar": "7.5.12",
-        "uglify-js": "3.19.3"
+        "uglify-js": "3.19.3",
+        "validate-npm-package-name": "7.0.2"
     }
 }