@node-red/registry 4.1.9 → 4.1.10

package/lib/installer.js

@@ -147,8 +147,7 @@ async function installModule(module,version,url) {
         var isExisting = false;
         if (url) {
             if (pkgurlRe.test(url) || localtgzRe.test(url)) {
-                // Git remote url or Tarball url - check the valid package url
-                installName = localtgzRe.test(url) && slashRe.test(url) ? `"${url}"` : url;
+                installName = url;
                 isRegistryPackage = false;
             } else {
                 log.warn(log._("server.install.install-failed-url",{name:module,url:url}));
@@ -504,12 +503,13 @@ async function getTarballModuleInfo(tarball) {
 
 function uninstallModule(module) {
     // This function is called when the admin api is called to remove a module.
-    // A check in node.js#removeModule verifies the module being removed is already in the registry
+    // A check in nodes.js#removeModule verifies the module being removed is already in the registry
     // as a user module. As such, we can have confidence that the `module` passed here is 
-    // a valid and recognised module name.
+    // a valid and recognised module name. But lets not rely 100% on that.
     activePromise = activePromise.then(() => {
         return new Promise((resolve,reject) => {
-            if (/[.\s;]/.test(module)) {
+            // Ensure its a valid package name and nothing has slipped through other checks
+            if (!validateNpmPackageName(module).validForOldPackages) {
                 reject(new Error(log._("server.install.invalid")));
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@node-red/registry",
-    "version": "4.1.9",
+    "version": "4.1.10",
     "license": "Apache-2.0",
     "main": "./lib/index.js",
     "repository": {
@@ -16,7 +16,7 @@
         }
     ],
     "dependencies": {
-        "@node-red/util": "4.1.9",
+        "@node-red/util": "4.1.10",
         "clone": "2.1.2",
         "fs-extra": "11.3.0",
         "npm": "^10.9.8",