@pnpm/network.web-auth 1101.2.0 → 1101.3.0

package/CHANGELOG.md

@@ -0,0 +1,16 @@
+# @pnpm/network.web-auth
+
+## 1101.3.0
+
+### Minor Changes
+
+- The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll [pnpm/pnpm#12721](https://github.com/pnpm/pnpm/issues/12721).
+
+- When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication [pnpm/pnpm#12721](https://github.com/pnpm/pnpm/issues/12721).
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.0

package/lib/formatAuthUrlMessage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Formats the "Authenticate your account at" message for an authentication
+ * URL, appending a QR code rendering of it when one can be generated.
+ *
+ * The URL itself is the authentication mechanism and the QR code only a
+ * convenience, so a QR generation failure (e.g. a URL exceeding the maximum
+ * QR data capacity) downgrades to a `globalWarn` and a URL-only message
+ * instead of aborting the authentication flow.
+ */
+export declare function formatAuthUrlMessage(authUrl: string, globalWarn: (message: string) => void): string;

package/lib/formatAuthUrlMessage.js

@@ -0,0 +1,22 @@
+import { generateQrCode } from './generateQrCode.js';
+/**
+ * Formats the "Authenticate your account at" message for an authentication
+ * URL, appending a QR code rendering of it when one can be generated.
+ *
+ * The URL itself is the authentication mechanism and the QR code only a
+ * convenience, so a QR generation failure (e.g. a URL exceeding the maximum
+ * QR data capacity) downgrades to a `globalWarn` and a URL-only message
+ * instead of aborting the authentication flow.
+ */
+export function formatAuthUrlMessage(authUrl, globalWarn) {
+    let qrCode;
+    try {
+        qrCode = generateQrCode(authUrl);
+    }
+    catch (err) {
+        globalWarn(`Could not generate a QR code: ${String(err)}`);
+        return `Authenticate your account at:\n${authUrl}`;
+    }
+    return `Authenticate your account at:\n${authUrl}\n\n${qrCode}`;
+}
+//# sourceMappingURL=formatAuthUrlMessage.js.map

package/lib/index.d.ts

@@ -1,5 +1,6 @@
+export { formatAuthUrlMessage } from './formatAuthUrlMessage.js';
 export { generateQrCode } from './generateQrCode.js';
-export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
+export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseBody, type WebAuthFetchResponseBodyReader, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
 export { canonicalHttpUrl, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -1,3 +1,4 @@
+export { formatAuthUrlMessage } from './formatAuthUrlMessage.js';
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, } from './promptBrowserOpen.js';

package/lib/pollForWebAuthToken.d.ts

@@ -12,7 +12,19 @@ export interface WebAuthFetchOptions {
 export interface WebAuthFetchResponseHeaders {
     get: (name: string) => string | null;
 }
+export interface WebAuthFetchResponseBodyReader {
+    read: () => Promise<{
+        done: boolean;
+        value?: Uint8Array;
+    }>;
+    cancel: () => Promise<void>;
+}
+export interface WebAuthFetchResponseBody {
+    cancel: () => Promise<void>;
+    getReader: () => WebAuthFetchResponseBodyReader;
+}
 export interface WebAuthFetchResponse {
+    readonly body?: WebAuthFetchResponseBody | null;
     readonly headers: WebAuthFetchResponseHeaders;
     readonly json: () => Promise<unknown>;
     readonly ok: boolean;

package/lib/pollForWebAuthToken.js

@@ -1,4 +1,11 @@
 import { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
+/**
+ * The most bytes of a poll response body that are read. The expected body is
+ * a small JSON object carrying the token, and the URL it comes from is
+ * registry-controlled, so an unbounded read on every poll tick would let a
+ * malicious or compromised registry grow memory at will.
+ */
+const TOKEN_BODY_LIMIT = 64 * 1024;
 /**
  * Polls a registry's "done" URL until an authentication token is returned.
  *
@@ -27,9 +34,12 @@ export async function pollForWebAuthToken({ context: { Date, fetch, setTimeout }
         catch {
             continue;
         }
-        if (!response.ok)
+        if (!response.ok) {
+            discardBody(response);
             continue;
+        }
         if (response.status === 202) {
+            discardBody(response);
             // Registry is still waiting for authentication.
             // Respect Retry-After header if present by waiting the additional time
             // beyond the default poll interval already elapsed above, but do not
@@ -50,17 +60,86 @@ export async function pollForWebAuthToken({ context: { Date, fetch, setTimeout }
             }
             continue;
         }
-        let body;
+        // eslint-disable-next-line no-await-in-loop
+        const body = await readTokenBody(response);
+        if (body?.token) {
+            return body.token;
+        }
+    }
+}
+/**
+ * Reads and parses a poll response body, applying {@link TOKEN_BODY_LIMIT}
+ * when the raw stream is exposed. Returns `undefined` — which the poll loop
+ * treats the same as an unparsable body, retrying on the next tick — for an
+ * oversized or truncated body.
+ */
+async function readTokenBody(response) {
+    // A response that exposes no readable body stream can only be read whole via
+    // json(), which the size cap cannot bound. The production undici-backed fetch
+    // always exposes `body` as a ReadableStream, so this uncapped path is reached
+    // only by stream-less WebAuthFetch stand-ins (the json()-based test mocks);
+    // every real transport goes through the capped stream read below.
+    if (response.body === undefined) {
         try {
-            // eslint-disable-next-line no-await-in-loop
-            body = await response.json();
+            return await response.json();
         }
         catch {
-            continue;
+            return undefined;
         }
-        if (body.token) {
-            return body.token;
+    }
+    const contentLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(contentLength) && contentLength > TOKEN_BODY_LIMIT) {
+        discardBody(response);
+        return undefined;
+    }
+    if (response.body === null)
+        return undefined;
+    let reader;
+    try {
+        reader = response.body.getReader();
+    }
+    catch {
+        return undefined;
+    }
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            // eslint-disable-next-line no-await-in-loop
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value == null)
+                continue;
+            total += value.length;
+            if (total > TOKEN_BODY_LIMIT) {
+                reader.cancel().catch(() => { });
+                return undefined;
+            }
+            chunks.push(value);
         }
     }
+    catch {
+        return undefined;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(Buffer.concat(chunks)));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Cancels a response body the poll loop will not read (non-ok and 202
+ * responses), so its payload is not transferred on every poll tick.
+ */
+function discardBody(response) {
+    try {
+        response.body?.cancel().catch(() => { });
+    }
+    catch {
+        // Cancellation is best-effort: a body that cannot be cancelled is simply
+        // left unread.
+    }
 }
 //# sourceMappingURL=pollForWebAuthToken.js.map

package/lib/withOtpHandling.js

@@ -1,5 +1,5 @@
 import { PnpmError } from '@pnpm/error';
-import { generateQrCode } from './generateQrCode.js';
+import { formatAuthUrlMessage } from './formatAuthUrlMessage.js';
 import { pollForWebAuthToken } from './pollForWebAuthToken.js';
 import { promptBrowserOpen } from './promptBrowserOpen.js';
 export const isOtpError = (error) => error != null &&
@@ -22,7 +22,7 @@ export const isOtpError = (error) => error != null &&
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
  */
 export async function withOtpHandling({ context, fetchOptions, operation, }) {
-    const { enquirer, globalInfo, process, } = context;
+    const { enquirer, globalInfo, globalWarn, process, } = context;
     try {
         return await operation();
     }
@@ -36,8 +36,7 @@ export async function withOtpHandling({ context, fetchOptions, operation, }) {
         const authUrl = canonicalHttpUrl(error.body?.authUrl);
         const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
         if (authUrl != null && doneUrl != null) {
-            const qrCode = generateQrCode(authUrl);
-            globalInfo(`Authenticate your account at:\n${authUrl}\n\n${qrCode}`);
+            globalInfo(formatAuthUrlMessage(authUrl, globalWarn));
             const pollPromise = pollForWebAuthToken({
                 context,
                 doneUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1101.2.0",
+  "version": "1101.3.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
     "!*.map"
   ],
   "dependencies": {
+    "@pnpm/error": "1100.1.0",
     "open": "^11.0.0",
-    "qrcode-terminal": "^0.12.0",
-    "@pnpm/error": "1100.0.1"
+    "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@types/qrcode-terminal": "^0.12.2",
-    "@pnpm/network.web-auth": "1101.2.0"
+    "@pnpm/network.web-auth": "1101.3.0",
+    "@types/qrcode-terminal": "^0.12.2"
   },
   "engines": {
     "node": ">=22.13"