@verdaccio/store 8.0.0-next-8.2 → 8.0.0-next-8.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +39 -0
- package/build/storage.js +11 -0
- package/build/storage.js.map +1 -1
- package/package.json +14 -14
- package/src/storage.ts +8 -0
- package/test/search.spec.ts +1 -0
- package/test/star-utils.test.ts +2 -0
- package/test/storage-utils.spec.ts +2 -0
- package/test/storage.spec.ts +271 -258
- package/test/versions.spec.ts +3 -2
- package/jest.config.js +0 -12
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,44 @@
|
|
|
1
1
|
# @verdaccio/store
|
|
2
2
|
|
|
3
|
+
## 8.0.0-next-8.4
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [48aa89f]
|
|
8
|
+
- Updated dependencies [58e0d95]
|
|
9
|
+
- @verdaccio/core@8.0.0-next-8.4
|
|
10
|
+
- @verdaccio/proxy@8.0.0-next-8.4
|
|
11
|
+
- @verdaccio/config@8.0.0-next-8.4
|
|
12
|
+
- @verdaccio/tarball@13.0.0-next-8.4
|
|
13
|
+
- @verdaccio/url@13.0.0-next-8.4
|
|
14
|
+
- @verdaccio/hooks@8.0.0-next-8.4
|
|
15
|
+
- @verdaccio/loaders@8.0.0-next-8.3
|
|
16
|
+
- @verdaccio/local-storage@13.0.0-next-8.4
|
|
17
|
+
- @verdaccio/search@8.0.0-next-8.4
|
|
18
|
+
- @verdaccio/utils@8.1.0-next-8.4
|
|
19
|
+
- @verdaccio/logger@8.0.0-next-8.4
|
|
20
|
+
|
|
21
|
+
## 8.0.0-next-8.3
|
|
22
|
+
|
|
23
|
+
### Patch Changes
|
|
24
|
+
|
|
25
|
+
- 5731e88: fix: code scan issues
|
|
26
|
+
- 5cfbc14: fix(api): add logging when requesting tarball
|
|
27
|
+
- Updated dependencies [5731e88]
|
|
28
|
+
- Updated dependencies [4afca90]
|
|
29
|
+
- Updated dependencies [5cfbc14]
|
|
30
|
+
- @verdaccio/local-storage@13.0.0-next-8.3
|
|
31
|
+
- @verdaccio/loaders@8.0.0-next-8.3
|
|
32
|
+
- @verdaccio/tarball@13.0.0-next-8.3
|
|
33
|
+
- @verdaccio/hooks@8.0.0-next-8.3
|
|
34
|
+
- @verdaccio/core@8.0.0-next-8.3
|
|
35
|
+
- @verdaccio/config@8.0.0-next-8.3
|
|
36
|
+
- @verdaccio/url@13.0.0-next-8.3
|
|
37
|
+
- @verdaccio/proxy@8.0.0-next-8.3
|
|
38
|
+
- @verdaccio/search@8.0.0-next-8.3
|
|
39
|
+
- @verdaccio/utils@8.1.0-next-8.3
|
|
40
|
+
- @verdaccio/logger@8.0.0-next-8.3
|
|
41
|
+
|
|
3
42
|
## 8.0.0-next-8.2
|
|
4
43
|
|
|
5
44
|
### Minor Changes
|
package/build/storage.js
CHANGED
|
@@ -184,6 +184,10 @@ class Storage {
|
|
|
184
184
|
async getTarballFromUpstream(name, filename, {
|
|
185
185
|
signal
|
|
186
186
|
}) {
|
|
187
|
+
this.logger.info({
|
|
188
|
+
name,
|
|
189
|
+
filename
|
|
190
|
+
}, 'get tarball for package @{name} filename @{filename} from uplink');
|
|
187
191
|
let cachedManifest = null;
|
|
188
192
|
try {
|
|
189
193
|
cachedManifest = await this.getPackageLocalMetadata(name);
|
|
@@ -305,6 +309,10 @@ class Storage {
|
|
|
305
309
|
async getTarball(name, filename, {
|
|
306
310
|
signal
|
|
307
311
|
}) {
|
|
312
|
+
this.logger.info({
|
|
313
|
+
name,
|
|
314
|
+
filename
|
|
315
|
+
}, 'get tarball for package @{name} filename @{filename}');
|
|
308
316
|
debug('get tarball for package %o filename %o', name, filename);
|
|
309
317
|
// TODO: check if isOpen is need it after all.
|
|
310
318
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
|
@@ -1219,6 +1227,9 @@ class Storage {
|
|
|
1219
1227
|
throw _core.errorUtils.getBadRequest(errorMessage);
|
|
1220
1228
|
}
|
|
1221
1229
|
}
|
|
1230
|
+
if (tarball === '__proto__' || tarball === 'constructor' || tarball === 'prototype') {
|
|
1231
|
+
throw _core.errorUtils.getBadRequest('tarball name is not allowed');
|
|
1232
|
+
}
|
|
1222
1233
|
data._attachments[tarball].version = version;
|
|
1223
1234
|
}
|
|
1224
1235
|
|