Function validatePolicy

deps/npm/lib/utils/resolve-allow-scripts.js:36–79

(policy, sourceLabel)

}

const validatePolicy = (policy, sourceLabel) => {
  // Drop and warn about keys with forbidden semver ranges (^, ~, >=, <, *).
  // The RFC only permits exact versions joined by `||`. Bare names like
  // `canvas` and explicit name-only wildcards (`canvas@*`) are allowed.
  if (!policy) {
    return policy
  }
  const cleaned = {}
  for (const [key, value] of Object.entries(policy)) {
    let parsed
    try {
      parsed = npa(key)
    } catch {
      log.warn('allow-scripts', `${sourceLabel}: ignoring unparseable entry "${key}"`)
      continue
    }
    if (parsed.type === 'tag') {
      // `pkg@latest`, `pkg@next`, etc. look like a pin but behave name-
      // only — the matcher has no way to verify what the tag points at
      // when scripts run. Reject for the same reason as semver ranges.
      log.warn(
        'allow-scripts',
        `${sourceLabel}: ignoring "${key}" — dist-tag specs (@latest, @next, ...) are not allowed; ` +
        'use exact versions joined by "||", or the bare package name, instead'
      )
      continue
    }
    if (parsed.type === 'range') {
      const isNameOnly = parsed.fetchSpec === '*'
        || parsed.rawSpec === ''
        || parsed.rawSpec === '*'
      if (!isNameOnly && !isExactVersionDisjunction(parsed.fetchSpec)) {
        log.warn(
          'allow-scripts',
          `${sourceLabel}: ignoring "${key}" — semver ranges (^, ~, >=, <) are not allowed; ` +
          'use exact versions joined by "||" instead'
        )
        continue
      }
    }
    cleaned[key] = value
  }
  return Object.keys(cleaned).length > 0 ? cleaned : null
}

// Resolve the effective allowScripts policy from the layered sources.
// Returns `{ policy, source }` where: