@vltpkg/dep-id 1.0.1 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/browser.js CHANGED
@@ -5,10 +5,17 @@ const EXTRA_PEER_SET_DELIMITER = 'peer.';
5
5
  const depIDRegExp = new RegExp(`^((git)?${delimiter}[^${delimiter}]*${delimiter}[^${delimiter}]*(${delimiter}[^${delimiter}]*)?$` +
6
6
  `|` +
7
7
  `^(file|remote|workspace)${delimiter}[^${delimiter}]*)(${delimiter}[^${delimiter}]*)?$`);
8
- export const isDepID = (str) => typeof str === 'string' && depIDRegExp.test(str);
8
+ /** Parsed dependency IDs must be safe store directory names. */
9
+ const pathUnsafeDepID = (str) => /[/\\\x00-\x1f\x7f]/.test(str) ||
10
+ /^[A-Za-z]:/.test(str) ||
11
+ str.split(delimiter).some(p => p === '.' || p === '..');
12
+ export const isDepID = (str) => typeof str === 'string' &&
13
+ depIDRegExp.test(str) &&
14
+ !pathUnsafeDepID(str);
9
15
  export const asDepID = (str) => {
10
16
  if (!isDepID(str)) {
11
- throw error('Expected dep id', {
17
+ throw error(`Expected dep id.`, {
18
+ code: 'EINVALIDNAME',
12
19
  found: str,
13
20
  });
14
21
  }
@@ -339,10 +346,11 @@ export const hydrateTuple = (tuple, name, options = {}) => {
339
346
  if (!first) {
340
347
  throw error('no name/path on workspace id', { found: tuple });
341
348
  }
349
+ const workspaceName = name ?? first.slice(first.lastIndexOf('/') + 1);
342
350
  res =
343
- name && name !== first ?
344
- Spec.parse(name, `workspace:${first}@*`, options)
345
- : Spec.parse(first, `workspace:*`, options);
351
+ workspaceName !== first ?
352
+ Spec.parse(workspaceName, `workspace:${first}@*`, options)
353
+ : Spec.parse(first, 'workspace:*', options);
346
354
  break;
347
355
  }
348
356
  }
package/dist/index.js CHANGED
@@ -119,10 +119,11 @@ export const hydrateTuple = (tuple, name, options = {}) => {
119
119
  if (!first) {
120
120
  throw error('no name/path on workspace id', { found: tuple });
121
121
  }
122
+ const workspaceName = name ?? first.slice(first.lastIndexOf('/') + 1);
122
123
  res =
123
- name && name !== first ?
124
- Spec.parse(name, `workspace:${first}@*`, options)
125
- : Spec.parse(first, `workspace:*`, options);
124
+ workspaceName !== first ?
125
+ Spec.parse(workspaceName, `workspace:${first}@*`, options)
126
+ : Spec.parse(first, 'workspace:*', options);
126
127
  break;
127
128
  }
128
129
  }
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@vltpkg/dep-id",
3
3
  "description": "create and hydrate dependency IDs",
4
- "version": "1.0.1",
4
+ "version": "1.0.3",
5
5
  "repository": {
6
6
  "type": "git",
7
7
  "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,9 +13,9 @@
13
13
  "url": "http://vlt.sh"
14
14
  },
15
15
  "dependencies": {
16
- "@vltpkg/error-cause": "1.0.1",
17
- "@vltpkg/spec": "1.0.1",
18
- "@vltpkg/types": "1.0.1"
16
+ "@vltpkg/error-cause": "1.0.3",
17
+ "@vltpkg/spec": "1.0.3",
18
+ "@vltpkg/types": "1.0.3"
19
19
  },
20
20
  "devDependencies": {
21
21
  "@eslint/js": "^9.39.1",