lib/npm: validate semver specs

zackschuster · zackschuster · commit 378da7ad6247 · 2022-03-03T09:52:30.000-08:00
diff --git a/lib/npm.js b/lib/npm.js
@@ -1,6 +1,7 @@
 'use strict'
 const execa = require('execa')
 const npa = require('npm-package-arg')
+const semver = require('semver')
 const validateNpmPackageName = require('validate-npm-package-name')
 
 // Remove npm env vars from the commands, this
@@ -53,6 +54,17 @@ function normalizePackageName (name, opts = {}) {
     throw new Error(`Invalid package type specifier (${pkg.type} - ${pkg.raw})`)
   }
 
+  if (
+    typeof pkg.rawSpec !== 'string' || (
+      pkg.rawSpec.length > 0 && (
+        semver.coerce(pkg.rawSpec, { loose: true }) == null && (
+          pkg.rawSpec === '*' || pkg.rawSpec.startsWith('<=') || pkg.rawSpec.startsWith('>=')
+        ) === false)
+    )
+  ) {
+    throw new Error(`Invalid package semver specifier (${pkg.rawSpec} - ${pkg.raw})`)
+  }
+
   switch (pkg.type) {
     // Directory checkes for package.json and
     // hosted means it looks like a remote repo or tarball
diff --git a/package.json b/package.json
@@ -38,6 +38,7 @@
 		"inquirer": "^5.2.0",
 		"npm-package-arg": "^7.0.0",
 		"safe-parse-list": "^0.1.1",
+		"semver": "^7.3.5",
 		"validate-npm-package-name": "^3.0.0"
 	},
 	"devDependencies": {
diff --git a/test/npm.js b/test/npm.js
@@ -0,0 +1,22 @@
+const assert = require('assert')
+const { suite, test } = require('mocha')
+
+const npm = require('../lib/npm')
+
+suite('npm', () => {
+  test('accept empty semver', () => {
+    assert.doesNotThrow(() => npm.normalizePackageName('@pkgjs/create'))
+  })
+  test('accept valid semver', () => {
+    assert.doesNotThrow(() => npm.normalizePackageName('@pkgjs/create@1.0.0'))
+    assert.doesNotThrow(() => npm.normalizePackageName('@pkgjs/create@<1'))
+  })
+  test('accept valid semver (exceptions)', () => {
+    assert.doesNotThrow(() => npm.normalizePackageName('@pkgjs/create@<=2'))
+    assert.doesNotThrow(() => npm.normalizePackageName('@pkgjs/create@>=2'))
+    assert.doesNotThrow(() => npm.normalizePackageName('@pkgjs/create@*'))
+  })
+  test('reject invalid semver', () => {
+    assert.throws(() => npm.normalizePackageName('@pkgjs/create@a.b.c'))
+  })
+})
