@pnpm/error 1100.2.1 → 1100.2.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @pnpm/error
 
+## 1100.2.2
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/constants@1102.0.1
+
 ## 1100.2.1
 
 ### Patch Changes

package/lib/index.d.ts

@@ -38,6 +38,19 @@ export declare class FetchTimeoutError extends PnpmError {
         cause: unknown;
     });
 }
+/**
+ * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
+ * text, e.g. `GET https://user:pass@host/pkg: ...` → `GET https://host/pkg: ...`.
+ * A registry configured as `https://user:pass@host/` would otherwise leak its
+ * embedded basic-auth credentials into every error message that interpolates
+ * the request URL (terminal output, CI logs). `FetchError` already hides the
+ * auth *header*; this covers credentials carried in the URL itself.
+ *
+ * Implemented as a single forward scan rather than a regex: `text` is
+ * uncontrolled (it interpolates the request URL), so a backtracking pattern is
+ * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
+ * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ */
 export declare function redactUrlCredentials(text: string): string;
 /**
  * Make untrusted, URL-bearing text safe to print or log: redact inline

package/lib/index.js

@@ -68,19 +68,6 @@ export class FetchTimeoutError extends PnpmError {
         });
     }
 }
-/**
- * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
- * text, e.g. `GET https://user:pass@host/pkg: …` → `GET https://host/pkg: …`.
- * A registry configured as `https://user:pass@host/` would otherwise leak its
- * embedded basic-auth credentials into every error message that interpolates
- * the request URL (terminal output, CI logs). `FetchError` already hides the
- * auth *header*; this covers credentials carried in the URL itself.
- *
- * Implemented as a single forward scan rather than a regex: `text` is
- * uncontrolled (it interpolates the request URL), so a backtracking pattern is
- * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
- * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
- */
 /**
  * A request URL made safe to print: its `user:pass@` userinfo and control
  * characters redacted ({@link redactAndSanitize}), then everything from the
@@ -107,6 +94,19 @@ function redactUrlSecrets(url) {
         return '[hidden]';
     return sanitized.split(/[?#]/)[0];
 }
+/**
+ * Strip `user:pass@` (or `user@`) userinfo that follows a URL scheme in any
+ * text, e.g. `GET https://user:pass@host/pkg: ...` → `GET https://host/pkg: ...`.
+ * A registry configured as `https://user:pass@host/` would otherwise leak its
+ * embedded basic-auth credentials into every error message that interpolates
+ * the request URL (terminal output, CI logs). `FetchError` already hides the
+ * auth *header*; this covers credentials carried in the URL itself.
+ *
+ * Implemented as a single forward scan rather than a regex: `text` is
+ * uncontrolled (it interpolates the request URL), so a backtracking pattern is
+ * a ReDoS vector, and the scan strips up to the **last** `@` in the authority
+ * so a raw `@` inside the password (`user:p@ss@host`) doesn't leak its tail.
+ */
 export function redactUrlCredentials(text) {
     let result = '';
     let cursor = 0;
@@ -122,21 +122,23 @@ export function redactUrlCredentials(text) {
         // bare `://` in the text is left untouched.
         if (schemeSep === 0 || !isSchemeTailChar(text.charCodeAt(schemeSep - 1)))
             continue;
-        // Userinfo runs to the last `@` within the authority, which itself ends at
-        // the first `/`, `?`, `#`, or whitespace.
-        let lastAt = -1;
-        for (let i = authorityStart; i < text.length; i++) {
-            const code = text.charCodeAt(i);
-            if (code === 0x2f || code === 0x3f || code === 0x23 || isAsciiWhitespace(code))
-                break;
-            if (code === 0x40)
-                lastAt = i;
-        }
-        if (lastAt !== -1)
-            cursor = lastAt + 1;
+        const userinfoEnd = findAuthorityUserinfoEnd(text, authorityStart);
+        if (userinfoEnd !== -1)
+            cursor = userinfoEnd;
     }
     return result;
 }
+function findAuthorityUserinfoEnd(text, authorityStart) {
+    let lastAt = -1;
+    for (let index = authorityStart; index < text.length; index++) {
+        const code = text.charCodeAt(index);
+        if (code === 0x2f || code === 0x3f || code === 0x23 || isAsciiWhitespace(code))
+            break;
+        if (code === 0x40)
+            lastAt = index;
+    }
+    return lastAt === -1 ? -1 : lastAt + 1;
+}
 /**
  * Make untrusted, URL-bearing text safe to print or log: redact inline
  * `user:pass@` credentials ({@link redactUrlCredentials}) and strip every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/error",
-  "version": "1100.2.1",
+  "version": "1100.2.2",
   "description": "An error class for pnpm errors",
   "keywords": [
     "pnpm",
@@ -28,11 +28,11 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/constants": "1102.0.0"
+    "@pnpm/constants": "1102.0.1"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/error": "1100.2.1"
+    "@pnpm/error": "1100.2.2"
   },
   "engines": {
     "node": ">=22.13"