Function policyFromSources

deps/npm/lib/utils/resolve-allow-scripts.js:21–34

(npm, sources)

// Read the `allow-scripts` value from one or more named config sources and
// build a policy object. Returns `null` if none of the sources has a value.
const policyFromSources = (npm, sources) => {
  for (const where of sources) {
    const value = npm.config.get?.('allow-scripts', where)
    if (value === undefined) {
      continue
    }
    const names = parseAllowScriptsList(value)
    /* istanbul ignore else: parseAllowScriptsList returns non-empty when value is set */
    if (names.length) {
      return buildPolicyFromNames(names)
    }
  }
  return null
}

const validatePolicy = (policy, sourceLabel) => {
  // Drop and warn about keys with forbidden semver ranges (^, ~, >=, <, *).