fix: explicitly allow `npm help` to open file:/// man pages

PR-URL: https://github.com/npm/cli/pull/4026
Credit: @wraithgar
Close: #4026
Reviewed-by: @isaacs

2 files changed, 11 insertions, 7 deletions

diff --git a/lib/commands/help.js b/lib/commands/help.js
index 0de047615..2986f917f 100644
--- a/lib/commands/help.js
+++ b/lib/commands/help.js
@@ -120,7 +120,7 @@ class Help extends BaseCommand {
         break
 
       case 'browser':
-        await openUrl(this.npm, this.htmlMan(man), 'help available at the following URL')
+        await openUrl(this.npm, this.htmlMan(man), 'help available at the following URL', true)
         return
 
       default:
diff --git a/lib/utils/open-url.js b/lib/utils/open-url.js
index ddbbddccf..eed2449dc 100644
--- a/lib/utils/open-url.js
+++ b/lib/utils/open-url.js
@@ -3,7 +3,7 @@ const opener = require('opener')
 const { URL } = require('url')
 
 // attempt to open URL in web-browser, print address otherwise:
-const open = async (npm, url, errMsg) => {
+const open = async (npm, url, errMsg, isFile) => {
   url = encodeURI(url)
   const browser = npm.config.get('browser')
 
@@ -24,12 +24,16 @@ const open = async (npm, url, errMsg) => {
     return
   }
 
-  try {
-    if (!/^https?:$/.test(new URL(url).protocol)) {
-      throw new Error()
+  // We pass this in as true from the help command so we know we don't have to
+  // check the protocol
+  if (!isFile) {
+    try {
+      if (!/^https?:$/.test(new URL(url).protocol)) {
+        throw new Error()
+      }
+    } catch (_) {
+      throw new Error('Invalid URL: ' + url)
     }
-  } catch (_) {
-    throw new Error('Invalid URL: ' + url)
   }
 
   const command = browser === true ? null : browser