npq 3.21.1 → 3.21.2

package/lib/marshalls/expiredDomains.marshall.js

@@ -14,45 +14,62 @@ class Marshall extends BaseMarshall {
     super(options)
     this.name = MARSHALL_NAME
     this.categoryId = marshallCategories.PackageHealth.id
+    this.dnsResolver = options.dnsResolver || dns
   }
 
   title() {
     return 'Detecting expired domains for authors account...'
   }
 
-  validate(pkg) {
-    return this.packageRepoUtils
-      .getPackageInfo(pkg.packageName)
-      .then((data) => {
-        const lastVersionData =
-          data.versions && data['dist-tags'] && data.versions[data['dist-tags'].latest]
-
-        const maintainersAccounts = lastVersionData && lastVersionData.maintainers
-
-        if (!Array.isArray(maintainersAccounts) || maintainersAccounts.length === 0) {
-          throw new NotEvaluated('no maintainers information available for the package')
-        }
-
-        const testEmails = []
-        for (const maintainerInfo of maintainersAccounts) {
-          const maintainerEmail = maintainerInfo.email
-          const emailDomain = maintainerEmail.split('@')[1]
-          testEmails.push(dns.resolve(emailDomain, 'NS'))
-        }
-
-        return Promise.all(testEmails)
-      })
-      .catch((error) => {
-        if (error instanceof NotEvaluated) {
-          throw error
-        }
-
-        const emailHostname = error.hostname ? error.hostname : '<unknown>'
-        this.debug('\nDetected error resolving domain for maintainer e-mail: %s', emailHostname)
-        throw new Error(
-          'Detected expired domain can be abused for account takeover: ' + emailHostname
-        )
-      })
+  async validate(pkg) {
+    const data = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
+    const lastVersionData =
+      data.versions && data['dist-tags'] && data.versions[data['dist-tags'].latest]
+
+    const maintainersAccounts = lastVersionData && lastVersionData.maintainers
+
+    if (!Array.isArray(maintainersAccounts) || maintainersAccounts.length === 0) {
+      throw new NotEvaluated('no maintainers information available for the package')
+    }
+
+    const emailDomains = []
+    let invalidMaintainers = 0
+    for (const maintainerInfo of maintainersAccounts) {
+      const maintainerEmail = maintainerInfo && maintainerInfo.email
+      const atIndex = typeof maintainerEmail === 'string' ? maintainerEmail.lastIndexOf('@') : -1
+      const emailDomain = atIndex > 0 ? maintainerEmail.slice(atIndex + 1).trim() : ''
+
+      if (!emailDomain || emailDomain.includes('@') || /\s/.test(emailDomain)) {
+        invalidMaintainers += 1
+        continue
+      }
+
+      emailDomains.push(emailDomain)
+    }
+
+    if (emailDomains.length === 0) {
+      throw new NotEvaluated('no valid maintainer email domains are available for the package')
+    }
+
+    let resolutionResults
+    try {
+      resolutionResults = await Promise.all(
+        emailDomains.map((emailDomain) => this.dnsResolver.resolve(emailDomain, 'NS'))
+      )
+    } catch (error) {
+      const emailHostname = error.hostname ? error.hostname : '<unknown>'
+      this.debug('\nDetected error resolving domain for maintainer e-mail: %s', emailHostname)
+      throw new Error(
+        'Detected expired domain can be abused for account takeover: ' + emailHostname
+      )
+    }
+
+    if (invalidMaintainers > 0) {
+      const noun = invalidMaintainers === 1 ? 'address is' : 'addresses are'
+      throw new NotEvaluated(`${invalidMaintainers} maintainer email ${noun} missing or malformed`)
+    }
+
+    return resolutionResults
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.21.1",
+  "version": "3.21.2",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",