diff options
author | isaacs <i@izs.me> | 2020-03-03 00:55:02 +0300 |
---|---|---|
committer | isaacs <i@izs.me> | 2020-05-08 04:11:52 +0300 |
commit | feae8e3d2450dbecc9363c7f40d69cead8eb12bd (patch) | |
tree | 1bfbafe44ff691b0161dc1fb1f555e78e786492b /lib | |
parent | a982571a9cc1ddaf4c2bce4e47f665a2adf70da1 (diff) |
Do not open URL in a browser unless valid
This is a defense for all cases where we might be trying to open a web
url based on either a response from the server, or some form of user
input. As far as we can tell, they're all being validated, but defense
in depth is always a good idea.
Diffstat (limited to 'lib')
-rw-r--r-- | lib/utils/open-url.js | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/lib/utils/open-url.js b/lib/utils/open-url.js index e1ed2b3fa..58227f039 100644 --- a/lib/utils/open-url.js +++ b/lib/utils/open-url.js @@ -3,6 +3,16 @@ const npm = require('../npm.js') const output = require('./output.js') const opener = require('opener') +const {URL} = require('url') + +const isUrlValid = url => { + try { + return /^https?:$/.test(new URL(url).protocol) + } catch (_) { + return false + } +} + // attempt to open URL in web-browser, print address otherwise: module.exports = function open (url, errMsg, cb, browser = npm.config.get('browser')) { function printAlternateMsg () { @@ -24,6 +34,10 @@ module.exports = function open (url, errMsg, cb, browser = npm.config.get('brows return cb() } + if (!isUrlValid(url)) { + return cb(new Error('Invalid URL: ' + url)) + } + opener(url, { command: browser }, (er) => { if (er && er.code === 'ENOENT') { printAlternateMsg() |