Do not open URL in a browser unless valid

This is a defense for all cases where we might be trying to open a web
url based on either a response from the server, or some form of user
input.  As far as we can tell, they're all being validated, but defense
in depth is always a good idea.

1 files changed, 14 insertions, 0 deletions

diff --git a/lib/utils/open-url.js b/lib/utils/open-url.js
index e1ed2b3fa..58227f039 100644
--- a/lib/utils/open-url.js
+++ b/lib/utils/open-url.js
@@ -3,6 +3,16 @@ const npm = require('../npm.js')
 const output = require('./output.js')
 const opener = require('opener')
 
+const {URL} = require('url')
+
+const isUrlValid = url => {
+  try {
+    return /^https?:$/.test(new URL(url).protocol)
+  } catch (_) {
+    return false
+  }
+}
+
 // attempt to open URL in web-browser, print address otherwise:
 module.exports = function open (url, errMsg, cb, browser = npm.config.get('browser')) {
   function printAlternateMsg () {
@@ -24,6 +34,10 @@ module.exports = function open (url, errMsg, cb, browser = npm.config.get('brows
     return cb()
   }
 
+  if (!isUrlValid(url)) {
+    return cb(new Error('Invalid URL: ' + url))
+  }
+
   opener(url, { command: browser }, (er) => {
     if (er && er.code === 'ENOENT') {
       printAlternateMsg()