deps & module-name: allow spaces in _from, trim spaces in module name

Some buggy clients write spaces to the _from field in package.json's in the
form of `name @spec`.  Here we ensure that we don't do that and allow for
times when someone else did that.

PR-URL: https://github.com/npm/npm/pull/18117
Credit: @IgorNadj
Reviewed-By: @iarna

2 files changed, 4 insertions, 3 deletions

diff --git a/lib/install/deps.js b/lib/install/deps.js
index 8ba6cdc64..c93907a41 100644
--- a/lib/install/deps.js
+++ b/lib/install/deps.js
@@ -62,8 +62,9 @@ function doesChildVersionMatch (child, requested, requestor) {
     // In those cases _from, will be preserved and we can compare that to ensure that they
     // really came from the same sources.
     // You'll see this scenario happen with at least tags and git dependencies.
+    // Some buggy clients will write spaces into the module name part of a _from.
     if (child.package._from) {
-      var fromReq = npa.resolve(moduleName(child), child.package._from.replace(new RegExp('^' + moduleName(child) + '@'), ''))
+      var fromReq = npa.resolve(moduleName(child), child.package._from.replace(new RegExp('^\s*' + moduleName(child) + '\s*@'), ''))
       if (fromReq.rawSpec === requested.rawSpec) return true
       if (fromReq.type === requested.type && fromReq.saveSpec && fromReq.saveSpec === requested.saveSpec) return true
     }
diff --git a/lib/utils/module-name.js b/lib/utils/module-name.js
index 43e0f5fb1..b42f5ca57 100644
--- a/lib/utils/module-name.js
+++ b/lib/utils/module-name.js
@@ -11,7 +11,7 @@ function pathToPackageName (dir) {
   var name = path.relative(path.resolve(dir, '..'), dir)
   var scoped = path.relative(path.resolve(dir, '../..'), dir)
   if (scoped[0] === '@') return scoped.replace(/\\/g, '/')
-  return name
+  return name.trim()
 }
 
 module.exports.test.isNotEmpty = isNotEmpty
@@ -22,7 +22,7 @@ function isNotEmpty (str) {
 var unknown = 0
 function moduleName (tree) {
   var pkg = tree.package || tree
-  if (isNotEmpty(pkg.name)) return pkg.name
+  if (isNotEmpty(pkg.name)) return pkg.name.trim()
   var pkgName = pathToPackageName(tree.path)
   if (pkgName !== '') return pkgName
   if (tree._invalidName != null) return tree._invalidName