1 files changed, 16 insertions, 11 deletions

diff --git a/node_modules/npm-profile/index.js b/node_modules/npm-profile/index.js
index b7f753fb4..d9c48c131 100644
--- a/node_modules/npm-profile/index.js
+++ b/node_modules/npm-profile/index.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const fetch = require('npm-registry-fetch')
-const {HttpErrorBase} = require('npm-registry-fetch/errors.js')
+const { HttpErrorBase } = require('npm-registry-fetch/errors.js')
 const os = require('os')
 const pudding = require('figgy-pudding')
 const validate = require('aproba')
@@ -18,6 +18,16 @@ exports.listTokens = listTokens
 exports.removeToken = removeToken
 exports.createToken = createToken
 
+const url = require('url')
+
+const isValidUrl = u => {
+  if (u && typeof u === 'string') {
+    const p = url.parse(u)
+    return p.slashes && p.host && p.path && /^https?:$/.test(p.protocol)
+  }
+  return false
+}
+
 const ProfileConfig = pudding({
   creds: {},
   hostname: {},
@@ -76,21 +86,16 @@ function webAuth (opener, opts, body) {
   })).then(res => {
     return Promise.all([res, res.json()])
   }).then(([res, content]) => {
-    const {doneUrl, loginUrl} = content
+    const { doneUrl, loginUrl } = content
     process.emit('log', 'verbose', 'web auth', 'got response', content)
-    if (
-      typeof doneUrl !== 'string' ||
-      typeof loginUrl !== 'string' ||
-      !doneUrl ||
-      !loginUrl
-    ) {
+    if (!isValidUrl(doneUrl) || !isValidUrl(loginUrl)) {
       throw new WebLoginInvalidResponse('POST', res, content)
     }
     return content
-  }).then(({doneUrl, loginUrl}) => {
+  }).then(({ doneUrl, loginUrl }) => {
     process.emit('log', 'verbose', 'web auth', 'opening url pair')
     return opener(loginUrl).then(
-      () => webAuthCheckLogin(doneUrl, opts.concat({cache: false}))
+      () => webAuthCheckLogin(doneUrl, opts.concat({ cache: false }))
     )
   }).catch(er => {
     if ((er.statusCode >= 400 && er.statusCode <= 499) || er.statusCode === 500) {
@@ -183,7 +188,7 @@ function loginCouch (username, password, opts) {
     }
     if (err.code !== 'E409') throw err
     return fetch.json(target, opts.concat({
-      query: {write: true}
+      query: { write: true }
     })).then(result => {
       Object.keys(result).forEach(function (k) {
         if (!body[k] || k === 'roles') {