@pnpm/error 1100.0.0 → 1100.0.1

package/README.md

@@ -3,7 +3,7 @@
 > An error class for pnpm errors
 
 <!--@shields('npm')-->
-[![npm version](https://img.shields.io/npm/v/@pnpm/error.svg)](https://www.npmjs.com/package/@pnpm/error)
+[![npm version](https://img.shields.io/npm/v/@pnpm/error.svg)](https://npmx.dev/package/@pnpm/error)
 <!--/@-->
 
 ## Installation

package/lib/index.d.ts

@@ -27,6 +27,20 @@ export declare class FetchError extends PnpmError {
     readonly request: FetchErrorRequest;
     constructor(request: FetchErrorRequest, response: FetchErrorResponse, hint?: string);
 }
+/**
+ * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
+ * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
+ * A registry configured as `https://user:pass@host/` would otherwise leak its
+ * embedded basic-auth credentials into every error message that interpolates
+ * the request URL (terminal output, CI logs). `FetchError` already hides the
+ * auth *header*; this covers credentials carried in the URL itself.
+ *
+ * Implemented as a single forward scan rather than a regex: `text` is
+ * uncontrolled (it interpolates the request URL), so a backtracking pattern is
+ * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
+ * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ */
+export declare function redactUrlCredentials(text: string): string;
 export declare class LockfileMissingDependencyError extends PnpmError {
     constructor(depPath: string);
 }

package/lib/index.js

@@ -22,7 +22,7 @@ export class FetchError extends PnpmError {
         if (request.authHeaderValue) {
             _request.authHeaderValue = hideAuthInformation(request.authHeaderValue);
         }
-        const message = `GET ${request.url}: ${response.statusText} - ${response.status}`;
+        const message = `GET ${redactUrlCredentials(request.url)}: ${response.statusText} - ${response.status}`;
         // NOTE: For security reasons, some registries respond with 404 on authentication errors as well.
         // So we print authorization info on 404 errors as well.
         if (response.status === 401 || response.status === 403 || response.status === 404) {
@@ -39,6 +39,55 @@ export class FetchError extends PnpmError {
         this.response = response;
     }
 }
+/**
+ * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
+ * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
+ * A registry configured as `https://user:pass@host/` would otherwise leak its
+ * embedded basic-auth credentials into every error message that interpolates
+ * the request URL (terminal output, CI logs). `FetchError` already hides the
+ * auth *header*; this covers credentials carried in the URL itself.
+ *
+ * Implemented as a single forward scan rather than a regex: `text` is
+ * uncontrolled (it interpolates the request URL), so a backtracking pattern is
+ * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
+ * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ */
+export function redactUrlCredentials(text) {
+    let result = '';
+    let cursor = 0;
+    while (cursor < text.length) {
+        const schemeSep = text.indexOf('://', cursor);
+        if (schemeSep === -1)
+            return result + text.slice(cursor);
+        const authorityStart = schemeSep + 3;
+        result += text.slice(cursor, authorityStart);
+        cursor = authorityStart;
+        // Only treat `://` as a URL authority boundary when a scheme character
+        // (schemes end in an ASCII alphanumeric) sits right before it; otherwise a
+        // bare `://` in the text is left untouched.
+        if (schemeSep === 0 || !isSchemeTailChar(text.charCodeAt(schemeSep - 1)))
+            continue;
+        // Userinfo runs to the last `@` within the authority, which itself ends at
+        // the first `/`, `?`, `#`, or whitespace.
+        let lastAt = -1;
+        for (let i = authorityStart; i < text.length; i++) {
+            const code = text.charCodeAt(i);
+            if (code === 0x2f || code === 0x3f || code === 0x23 || isAsciiWhitespace(code))
+                break;
+            if (code === 0x40)
+                lastAt = i;
+        }
+        if (lastAt !== -1)
+            cursor = lastAt + 1;
+    }
+    return result;
+}
+function isSchemeTailChar(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a);
+}
+function isAsciiWhitespace(code) {
+    return code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0b || code === 0x0c || code === 0x0d;
+}
 function hideAuthInformation(authHeaderValue) {
     const [authType, token] = authHeaderValue.split(' ');
     if (token == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.0.0",
+  "version": "1100.0.1",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -9,8 +9,11 @@
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/core/error",
-  "homepage": "https://github.com/pnpm/pnpm/tree/main/core/error#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/core/error"
+  },
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/core/error#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
   },
@@ -28,7 +31,8 @@
     "@pnpm/constants": "1100.0.0"
   },
   "devDependencies": {
-    "@pnpm/error": "1100.0.0"
+    "@jest/globals": "30.4.1",
+    "@pnpm/error": "1100.0.1"
   },
   "engines": {
     "node": ">=22.13"