@pnpm/error 1100.1.3 → 1100.1.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/error
 
+## 1100.1.4
+
+### Patch Changes
+
+- Fetch and tarball errors no longer print the secrets of the URL they name. Inline `user:pass@` credentials and the query string or fragment of a signed URL are hidden, so a failed install or `pnpm add <url>` cannot leak them into terminal scrollback or CI logs.
+
 ## 1100.1.3
 
 ### Patch Changes

package/lib/index.d.ts

@@ -27,19 +27,6 @@ export declare class FetchError extends PnpmError {
     readonly request: FetchErrorRequest;
     constructor(request: FetchErrorRequest, response: FetchErrorResponse, hint?: string);
 }
-/**
- * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
- * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
- * A registry configured as `https://user:pass@host/` would otherwise leak its
- * embedded basic-auth credentials into every error message that interpolates
- * the request URL (terminal output, CI logs). `FetchError` already hides the
- * auth *header*; this covers credentials carried in the URL itself.
- *
- * Implemented as a single forward scan rather than a regex: `text` is
- * uncontrolled (it interpolates the request URL), so a backtracking pattern is
- * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
- * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
- */
 export declare function redactUrlCredentials(text: string): string;
 /**
  * Make untrusted, URL-bearing text safe to print or log: redact inline

package/lib/index.js

@@ -22,7 +22,7 @@ export class FetchError extends PnpmError {
         if (request.authHeaderValue) {
             _request.authHeaderValue = hideAuthInformation(request.authHeaderValue);
         }
-        const message = `GET ${redactUrlCredentials(request.url)}: ${response.statusText} - ${response.status}`;
+        const message = `GET ${redactUrlSecrets(request.url)}: ${response.statusText} - ${response.status}`;
         // NOTE: For security reasons, some registries respond with 404 on authentication errors as well.
         // So we print authorization info on 404 errors as well.
         if (response.status === 401 || response.status === 403 || response.status === 404) {
@@ -52,6 +52,32 @@ export class FetchError extends PnpmError {
  * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
  * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
  */
+/**
+ * A request URL made safe to print: its `user:pass@` userinfo and control
+ * characters redacted ({@link redactAndSanitize}), then everything from the
+ * query or fragment onwards dropped — a signed tarball or registry URL
+ * carries a reusable token there, which credential redaction alone keeps.
+ *
+ * `[hidden]` when the cut would leave credential material behind. A password
+ * containing `?` or `#` defeats the userinfo scan — it reads the `?` as the
+ * end of the authority and leaves the whole `user:pa?ss@host` in place — so
+ * cutting there would publish the password's prefix. The authority is
+ * therefore checked before the cut, not after: any `@` still in front of the
+ * path means the userinfo survived.
+ *
+ * Cuts rather than re-rendering through `URL`, unlike
+ * {@link redactUrlForDisplay}: that round-trip normalizes the spelling
+ * (`https://host` gains a trailing slash, percent-escapes change case), and
+ * an error message should echo the URL the request was given.
+ */
+function redactUrlSecrets(url) {
+    const sanitized = redactAndSanitize(url);
+    const schemeEnd = sanitized.indexOf('://');
+    const afterScheme = schemeEnd === -1 ? sanitized : sanitized.slice(schemeEnd + '://'.length);
+    if (afterScheme.split('/')[0].includes('@'))
+        return '[hidden]';
+    return sanitized.split(/[?#]/)[0];
+}
 export function redactUrlCredentials(text) {
     let result = '';
     let cursor = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.1.3",
+  "version": "1100.1.4",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -32,7 +32,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.1.3"
+    "@pnpm/error": "1100.1.4"
   },
   "engines": {
     "node": ">=22.13"