Function versionedKeyFor

deps/npm/lib/utils/allow-scripts-writer.js:25–67

(node)

// for git, the resolved file path for local installs). Never falls back to
// `node.packageName` / `node.version`, which are tarball-controlled.
const versionedKeyFor = (node) => {
  if (!node) {
    return null
  }
  const resolved = primaryResolvedSource(node)
  if (resolved.startsWith('git')) {
    try {
      const parsed = npa(resolved)
      if (parsed.hosted) {
        const committish = parsed.gitCommittish || parsed.hosted.committish
        const base = parsed.hosted.shortcut({ noCommittish: true })
        return committish ? `${base}#${committish}` : base
      }
    } catch {
      /* istanbul ignore next: npa already parsed this string in keyTargetsNode */
      return null
    }
    return null
  }
  if (/^https?:\/\//.test(resolved)) {
    const trusted = getTrustedRegistryIdentity(node)
    if (trusted && trusted.version) {
      return `${trusted.name}@${trusted.version}`
    }
    // Registry node with a resolved URL that versionFromTgz couldn't
    // parse (private-registry mirror, alternate CDN URL shape). Leave a
    // breadcrumb so users notice when policy keys are silently pruned.
    log.silly(
      'allow-scripts',
      `unable to derive trusted versioned key for ${node.path || node.name || '<unknown>'} ` +
      `(resolved: ${resolved}); key will be pruned on next save`
    )
    return null
  }
  /* istanbul ignore next: 'file:' and '/' branches are each covered separately */
  if (resolved.startsWith('file:') || resolved.startsWith('/')) {
    return resolved
  }
  // No trusted source. Refuse to compose a key from attacker-controlled
  // `node.packageName` / `node.version`.
  /* istanbul ignore next: callers filter out non-registry/non-file nodes before reaching this fallback */
  return null
}

// Convert an arborist Node into the spec string used for a name-only policy
// entry. Same trust rules as versionedKeyFor — returns `null` rather than