@pnpm/error 1100.1.2 → 1100.1.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @pnpm/error
 
+## 1100.1.4
+
+### Patch Changes
+
+- Fetch and tarball errors no longer print the secrets of the URL they name. Inline `user:pass@` credentials and the query string or fragment of a signed URL are hidden, so a failed install or `pnpm add <url>` cannot leak them into terminal scrollback or CI logs.
+
+## 1100.1.3
+
+### Patch Changes
+
+- Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://github.com/pnpm/pnpm/issues/12042).
+
+- Updated dependencies:
+  - @pnpm/constants@1102.0.0
+
 ## 1100.1.2
 
 ### Patch Changes

package/lib/index.d.ts

@@ -27,19 +27,6 @@ export declare class FetchError extends PnpmError {
     readonly request: FetchErrorRequest;
     constructor(request: FetchErrorRequest, response: FetchErrorResponse, hint?: string);
 }
-/**
- * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
- * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
- * A registry configured as `https://user:pass@host/` would otherwise leak its
- * embedded basic-auth credentials into every error message that interpolates
- * the request URL (terminal output, CI logs). `FetchError` already hides the
- * auth *header*; this covers credentials carried in the URL itself.
- *
- * Implemented as a single forward scan rather than a regex: `text` is
- * uncontrolled (it interpolates the request URL), so a backtracking pattern is
- * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
- * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
- */
 export declare function redactUrlCredentials(text: string): string;
 /**
  * Make untrusted, URL-bearing text safe to print or log: redact inline
@@ -49,6 +36,13 @@ export declare function redactUrlCredentials(text: string): string;
  * or inject terminal output via raw escapes / `\r` / `\n`.
  */
 export declare function redactAndSanitize(text: string): string;
+/**
+ * Make a URL safe for user-visible output without exposing credentials,
+ * query parameters, fragments, or terminal control characters. Malformed
+ * URLs are replaced entirely because their authority cannot be redacted
+ * reliably.
+ */
+export declare function redactUrlForDisplay(url: string): string;
 /**
  * {@link redactAndSanitize} for text whose line breaks are worth keeping, such
  * as a subprocess's multi-line stderr.

package/lib/index.js

@@ -22,7 +22,7 @@ export class FetchError extends PnpmError {
         if (request.authHeaderValue) {
             _request.authHeaderValue = hideAuthInformation(request.authHeaderValue);
         }
-        const message = `GET ${redactUrlCredentials(request.url)}: ${response.statusText} - ${response.status}`;
+        const message = `GET ${redactUrlSecrets(request.url)}: ${response.statusText} - ${response.status}`;
         // NOTE: For security reasons, some registries respond with 404 on authentication errors as well.
         // So we print authorization info on 404 errors as well.
         if (response.status === 401 || response.status === 403 || response.status === 404) {
@@ -52,6 +52,32 @@ export class FetchError extends PnpmError {
  * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
  * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
  */
+/**
+ * A request URL made safe to print: its `user:pass@` userinfo and control
+ * characters redacted ({@link redactAndSanitize}), then everything from the
+ * query or fragment onwards dropped — a signed tarball or registry URL
+ * carries a reusable token there, which credential redaction alone keeps.
+ *
+ * `[hidden]` when the cut would leave credential material behind. A password
+ * containing `?` or `#` defeats the userinfo scan — it reads the `?` as the
+ * end of the authority and leaves the whole `user:pa?ss@host` in place — so
+ * cutting there would publish the password's prefix. The authority is
+ * therefore checked before the cut, not after: any `@` still in front of the
+ * path means the userinfo survived.
+ *
+ * Cuts rather than re-rendering through `URL`, unlike
+ * {@link redactUrlForDisplay}: that round-trip normalizes the spelling
+ * (`https://host` gains a trailing slash, percent-escapes change case), and
+ * an error message should echo the URL the request was given.
+ */
+function redactUrlSecrets(url) {
+    const sanitized = redactAndSanitize(url);
+    const schemeEnd = sanitized.indexOf('://');
+    const afterScheme = schemeEnd === -1 ? sanitized : sanitized.slice(schemeEnd + '://'.length);
+    if (afterScheme.split('/')[0].includes('@'))
+        return '[hidden]';
+    return sanitized.split(/[?#]/)[0];
+}
 export function redactUrlCredentials(text) {
     let result = '';
     let cursor = 0;
@@ -94,14 +120,27 @@ export function redactAndSanitize(text) {
     // userinfo (`user:pass\r@host`) would otherwise split the authority across
     // the redaction scan, and removing it afterwards would rejoin the
     // credentials into the output.
-    let sanitized = '';
-    for (const char of text) {
-        const code = char.codePointAt(0);
-        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
-            continue;
-        sanitized += char;
+    return redactUrlCredentials(sanitizeControlCharacters(text));
+}
+/**
+ * Make a URL safe for user-visible output without exposing credentials,
+ * query parameters, fragments, or terminal control characters. Malformed
+ * URLs are replaced entirely because their authority cannot be redacted
+ * reliably.
+ */
+export function redactUrlForDisplay(url) {
+    let display;
+    try {
+        display = new URL(sanitizeControlCharacters(url));
+    }
+    catch {
+        return '[hidden]';
     }
-    return redactUrlCredentials(sanitized);
+    display.username = '';
+    display.password = '';
+    display.search = '';
+    display.hash = '';
+    return display.href;
 }
 /**
  * {@link redactAndSanitize} for text whose line breaks are worth keeping, such
@@ -124,6 +163,16 @@ function isSchemeTailChar(code) {
 function isAsciiWhitespace(code) {
     return code === 0x20 || code === 0x09 || code === 0x0a || code === 0x0b || code === 0x0c || code === 0x0d;
 }
+function sanitizeControlCharacters(text) {
+    let sanitized = '';
+    for (const char of text) {
+        const code = char.codePointAt(0);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f))
+            continue;
+        sanitized += char;
+    }
+    return sanitized;
+}
 function hideAuthInformation(authHeaderValue) {
     const [authType, token] = authHeaderValue.split(' ');
     if (token == null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.1.2",
+  "version": "1100.1.4",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/constants": "1101.0.0"
+    "@pnpm/constants": "1102.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.1.2"
+    "@pnpm/error": "1100.1.4"
   },
   "engines": {
     "node": ">=22.13"