ls: fix filter when prerelease version present

If `ls` for a package without using a semver filter,
for example, `npm ls foo` vs `foo@1.2.3`, `ls` was using semver
ranges based on `*`, which doesn't match prerelease versions.

So, if you had installed a prerelease version (`foo@1.2.3-xyz`),
the `npm ls` will return no results for `foo`, at all.

This patch bypasses the semver check entirely when there's no semver
filter for the search.

Fixes: https://github.com/npm/npm/issues/9436
Credit: @zkat
PR-URL: https://github.com/npm/npm/pull/12685
Reviewed-By: @othiym23

1 files changed, 9 insertions, 2 deletions

diff --git a/lib/ls.js b/lib/ls.js
index 4a71c54e1..d2fe14fb2 100644
--- a/lib/ls.js
+++ b/lib/ls.js
@@ -62,7 +62,11 @@ var lsFromTree = ls.fromTree = function (dir, physicalTree, args, silent, cb) {
     args = args.map(function (a) {
       var p = npa(a)
       var name = p.name
-      var ver = semver.validRange(p.rawSpec) || ''
+      // When version spec is missing, we'll skip using it when filtering.
+      // Otherwise, `semver.validRange` would return '*', which won't
+      // match prerelease versions.
+      var ver = (p.rawSpec &&
+                 (semver.validRange(p.rawSpec) || ''))
       return [ name, ver, a ]
     })
   }
@@ -292,8 +296,11 @@ function filterFound (root, args) {
         var argName = args[ii][0]
         var argVersion = args[ii][1]
         var argRaw = args[ii][2]
-        if (depName === argName) {
+        if (depName === argName && argVersion) {
           found = semver.satisfies(dep.version, argVersion, true)
+        } else if (depName === argName) {
+          // If version is missing from arg, just do a name match.
+          found = true
         } else if (dep.path === argRaw) {
           found = true
         }