@node-red/registry 5.0.0-beta.5 → 5.0.0

package/lib/externalModules.js

@@ -12,11 +12,13 @@ const log = require("@node-red/util").log;
 const hooks = require("@node-red/util").hooks;
 const url = require("url");
 const { createRequire } = require("module");
+const validateNpmPackageName = require("validate-npm-package-name");
 
 const BUILTIN_MODULES = require('module').builtinModules;
 
-// TODO: outsource running npm to a plugin
-const NPM_COMMAND = (process.platform === "win32") ? "npm.cmd" : "npm";
+const npmPackageJson = require.resolve('npm/package.json')
+const npmRoot = path.dirname(npmPackageJson);
+const npmCli = path.join(npmRoot, 'bin', 'npm-cli.js');
 
 let registeredTypes = {};
 let subflowTypes = {};
@@ -246,6 +248,11 @@ async function installModule(moduleDetails) {
             e.code = "install_not_allowed";
             throw e;
         }
+        if (!validateNpmPackageName(moduleDetails.module).validForOldPackages) {
+            const e = new Error("Invalid module name");
+            e.code = "install_not_allowed";
+            throw e;
+        }
         if (moduleDetails.version) {
             installSpec = installSpec+"@"+moduleDetails.version;
         }
@@ -265,9 +272,9 @@ async function installModule(moduleDetails) {
             // - run install
             if (result !== false) {
                 let extraArgs = triggerPayload.args || [];
-                let args = ['install', ...extraArgs, installSpec]
-                log.trace(NPM_COMMAND + JSON.stringify(args));
-                return exec.run(NPM_COMMAND, args, { cwd: installDir, shell: true },true)
+                let args = [npmCli, 'install', ...extraArgs, '--', installSpec]
+                log.trace(`${process.execPath} ${npmCli} ${JSON.stringify(args)}`);
+                return exec.run(process.execPath, args, { cwd: installDir },true)
             } else {
                 log.trace("skipping npm install");
             }

package/lib/installer.js

@@ -29,12 +29,16 @@ const child_process = require('child_process');
 const plugins = require("./plugins");
 
 const isWindows = process.platform === 'win32'
-const npmCommand =  isWindows ? 'npm.cmd' : 'npm';
+
+const npmPackageJson = require.resolve('npm/package.json')
+const npmRoot = path.dirname(npmPackageJson);
+const npmCli = path.join(npmRoot, 'bin', 'npm-cli.js');
+
+const validateNpmPackageName = require("validate-npm-package-name");
 
 let installerEnabled = false;
 let settings;
 
-const moduleRe = /^(@[^/@]+?[/])?[^/@]+?$/;
 const slashRe = isWindows ? /\\|[/]/ : /[/]/;
 const pkgurlRe = /^(https?|git(|\+https?|\+ssh|\+file)):\/\//;
 const localtgzRe = /^([a-zA-Z]:|\/).+tgz$/;
@@ -143,8 +147,7 @@ async function installModule(module,version,url) {
         var isExisting = false;
         if (url) {
             if (pkgurlRe.test(url) || localtgzRe.test(url)) {
-                // Git remote url or Tarball url - check the valid package url
-                installName = localtgzRe.test(url) && slashRe.test(url) ? `"${url}"` : url;
+                installName = url;
                 isRegistryPackage = false;
             } else {
                 log.warn(log._("server.install.install-failed-url",{name:module,url:url}));
@@ -152,8 +155,8 @@ async function installModule(module,version,url) {
                 e.code = "invalid_module_url";
                 throw e;
             }
-        } else if (moduleRe.test(module)) {
-            // Simple module name - assume it can be npm installed
+        } else if (validateNpmPackageName(module).validForOldPackages) {
+            // A valid npm module name
             if (version) {
                 installName += "@"+version;
             }
@@ -169,9 +172,12 @@ async function installModule(module,version,url) {
             e.code = "invalid_module_name";
             throw e;
         }
+
         if (!installAllAllowed) {
             let installVersion = version;
-            if (installVersionRestricted && isRegistryPackage) {
+            if (isRegistryPackage) {
+                // For an registry module, this will validate the version exists before trying to install it
+                // It will throw an error if the version doesn't exist.
                 installVersion = await getModuleVersionFromNPM(module, version);
             }
 
@@ -228,9 +234,9 @@ async function installModule(module,version,url) {
             // - run install
             if (result !== false) {
                 let extraArgs = triggerPayload.args || [];
-                let args = ['install', ...extraArgs, installName]
-                log.trace(npmCommand + JSON.stringify(args));
-                return exec.run(npmCommand,args,{ cwd: installDir, shell: true }, true)
+                let args = [npmCli, 'install', ...extraArgs, '--', installName]
+                log.trace(`${process.execPath} ${npmCli} ${JSON.stringify(args)}`);
+                return exec.run(process.execPath, args, { cwd: installDir }, true)
             } else {
                 log.trace("skipping npm install");
             }
@@ -265,7 +271,7 @@ async function installModule(module,version,url) {
                 log.warn("------------------------------------------");
                 e = new Error(log._("server.install.install-failed")+": "+err.toString());
                 if (err.hook === "postInstall") {
-                    return exec.run(npmCommand,["remove",module],{ cwd: installDir, shell: true }, false).finally(() => {
+                    return exec.run(process.execPath, [npmCli, "remove", module],{ cwd: installDir }, false).finally(() => {
                         throw e;
                     })
                 }
@@ -370,7 +376,7 @@ async function getModuleVersionFromNPM(module, version) {
     
 
     return new Promise((resolve, reject) => {
-        child_process.execFile(`${npmCommand} info --json ${installName}`, { shell: true },function(err,stdout,stderr) {
+        child_process.execFile(process.execPath, [npmCli, 'info', '--json', '--', installName], function(err,stdout,stderr) {
             try {
                 if (!stdout) {
                     log.warn(log._("server.install.install-failed-not-found",{name:module}));
@@ -381,6 +387,7 @@ async function getModuleVersionFromNPM(module, version) {
                 }
                 const response = JSON.parse(stdout);
                 if (response.error) {
+                    console.log(response)
                     if (response.error.code === "E404") {
                         log.warn(log._("server.install.install-failed-not-found",{name:module}));
                         e = new Error("Module not found");
@@ -495,9 +502,14 @@ async function getTarballModuleInfo(tarball) {
 }
 
 function uninstallModule(module) {
+    // This function is called when the admin api is called to remove a module.
+    // A check in nodes.js#removeModule verifies the module being removed is already in the registry
+    // as a user module. As such, we can have confidence that the `module` passed here is 
+    // a valid and recognised module name. But lets not rely 100% on that.
     activePromise = activePromise.then(() => {
         return new Promise((resolve,reject) => {
-            if (/[\s;]/.test(module)) {
+            // Ensure its a valid package name and nothing has slipped through other checks
+            if (!validateNpmPackageName(module).validForOldPackages) {
                 reject(new Error(log._("server.install.invalid")));
                 return;
             }
@@ -527,9 +539,9 @@ function uninstallModule(module) {
                 // - run uninstall
                 if (result !== false) {
                     let extraArgs = triggerPayload.args || [];
-                    let args = ['remove', ...extraArgs, module]
-                    log.trace(npmCommand + JSON.stringify(args));
-                    return exec.run(npmCommand,args,{ cwd: installDir, shell: true }, true)
+                    let args = [npmCli, 'remove', ...extraArgs, '--', module]
+                    log.trace(`${process.execPath} ${npmCli} ${JSON.stringify(args)}`);
+                    return exec.run(process.execPath, args, { cwd: installDir }, true)
                 } else {
                     log.trace("skipping npm uninstall");
                 }
@@ -596,7 +608,7 @@ async function checkPrereq() {
         installerEnabled = false;
     } else {
         return new Promise(resolve => {
-            child_process.execFile(`${npmCommand} -v`,{ shell: true },function(err,stdout) {
+            child_process.execFile(process.execPath, [npmCli, '-v'], function(err,stdout) {
                 if (err) {
                     log.info(log._("server.palette-editor.npm-not-found"));
                     installerEnabled = false;

package/lib/loader.js

@@ -17,6 +17,7 @@
 var fs = require("fs-extra");
 var path = require("path");
 var semver = require("semver");
+const { pathToFileURL } = require('node:url');
 
 var localfilesystem = require("./localfilesystem");
 var registry = require("./registry");
@@ -66,7 +67,7 @@ function loadModuleTypeFiles(module, type) {
                     moduleFn = parts.slice(0,nmi+2).join(path.sep);
                 }
                 if (!moduleFn) {
-                    // shortcut - skip calling statSync on empty string 
+                    // shortcut - skip calling statSync on empty string
                     break; // Module not found, don't attempt to load its nodes
                 }
                 try {
@@ -356,34 +357,23 @@ function loadNodeSet(node) {
     } else {
     }
     try {
-        var loadPromise = null;
-        var r = require(node.file);
-        r = r.__esModule ? r.default : r
-        if (typeof r === "function") {
-
-            var red = registryUtil.createNodeApi(node);
-            var promise = r(red);
-            if (promise != null && typeof promise.then === "function") {
-                loadPromise = promise.then(function() {
-                    node.enabled = true;
-                    node.loaded = true;
-                    return node;
-                }).catch(function(err) {
-                    node.err = err;
-                    return node;
-                });
-            }
-        }
-        if (loadPromise == null) {
-            node.enabled = true;
-            node.loaded = true;
-            loadPromise = Promise.resolve(node);
-        }
-        return loadPromise;
+        const modulePath = pathToFileURL(node.file).href;
+        const importPromise = import(modulePath);
+        return importPromise
+            .then(function(moduleNamespaceObject) {
+                // CJS will always have default, ESM might have default. (details in note below)
+                let r = moduleNamespaceObject.default ? moduleNamespaceObject.default : moduleNamespaceObject;
+                // Babel related workaround, references in comment below.
+                r = r.__esModule ? r.default : r;
+                return createLoadPromise(node, r);
+            })
+            .catch(function(err) {
+                node.err = err;
+                return Promise.resolve(node);
+            });
     } catch(err) {
         node.err = err;
         var stack = err.stack;
-        var message;
         if (stack) {
             var filePath = node.file;
             try {
@@ -403,6 +393,45 @@ function loadNodeSet(node) {
         }
         return Promise.resolve(node);
     }
+
+    // Notes on default:
+    // https://nodejs.org/api/esm.html#import-expressions
+    // "When importing CommonJS modules, the module.exports object is provided as the default export."
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import
+    // "The module namespace object is a sealed object ... with the default export available as a key called `default`."
+
+    // Notes on __esModule:
+    // Workaround originally added in commit 326f3469, merged in pull request #3669.
+    // Related links:
+    // https://github.com/nodejs/node/issues/40891
+    // https://github.com/evanw/esbuild/issues/1591
+    // https://babeljs.io/docs/babel-plugin-transform-modules-commonjs
+    // https://stackoverflow.com/questions/50943704/whats-the-purpose-of-object-definepropertyexports-esmodule-value-0
+
+    function createLoadPromise(node, r) {
+        var loadPromise = null;
+        if (typeof r === "function") {
+
+            var red = registryUtil.createNodeApi(node);
+            var promise = r(red);
+            if (promise != null && typeof promise.then === "function") {
+                loadPromise = promise.then(function () {
+                    node.enabled = true;
+                    node.loaded = true;
+                    return node;
+                }).catch(function (err) {
+                    node.err = err;
+                    return node;
+                });
+            }
+        }
+        if (loadPromise == null) {
+            node.enabled = true;
+            node.loaded = true;
+            loadPromise = Promise.resolve(node);
+        }
+        return loadPromise;
+    }
 }
 
 async function loadPlugin(plugin) {
@@ -435,7 +464,6 @@ async function loadPlugin(plugin) {
         console.log(err);
         plugin.err = err;
         var stack = err.stack;
-        var message;
         if (stack) {
             var i = stack.indexOf(plugin.file);
             if (i > -1) {
@@ -449,7 +477,7 @@ async function loadPlugin(plugin) {
         return plugin;
     }
 }
-let invocation = 0
+
 function loadNodeSetList(nodes) {
     var promises = [];
     nodes.forEach(function(node) {
@@ -471,7 +499,6 @@ function addModule(module) {
     if (!settings.available()) {
         throw new Error("Settings unavailable");
     }
-    var nodes = [];
     var existingInfo = registry.getModuleInfo(module);
     if (existingInfo) {
         // TODO: nls

package/lib/util.js

@@ -128,6 +128,7 @@ function createNodeApi(node) {
         }
         return i18n._.apply(null,args);
     }
+    red.nodes.linkcallTargets = runtime.nodes.linkcallTargets;
     return red;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@node-red/registry",
-    "version": "5.0.0-beta.5",
+    "version": "5.0.0",
     "license": "Apache-2.0",
     "main": "./lib/index.js",
     "repository": {
@@ -16,11 +16,13 @@
         }
     ],
     "dependencies": {
-        "@node-red/util": "5.0.0-beta.5",
+        "@node-red/util": "5.0.0",
         "clone": "2.1.2",
         "fs-extra": "11.3.0",
+        "npm": "11.16.0",
         "semver": "7.7.4",
         "tar": "7.5.12",
-        "uglify-js": "3.19.3"
+        "uglify-js": "3.19.3",
+        "validate-npm-package-name": "7.0.2"
     }
 }