search

lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
781 stars 35 forks source link

allowed-hosts failing on urls with port and no scheme #93

Closed matthias-ccri closed 4 years ago

matthias-ccri commented 4 years ago

Hi there! We've been using lockfile-lint at our company. We have been specifying --allowed-hosts with a domain and port, like this: nexus.example.com:8089. Up until yesterday, this worked fine:

npx lockfile-lint --path package-lock.json --allowed-hosts nexus.example.com:8089 registry.npmjs.org

As of today, the above command results in false positives that look like this:

detected invalid host(s) for package: zero-crossings@1.0.1-72cbc63a942ee565369f9524fb69fdbe2d885364
    expected: ,registry.npmjs.org
    actual: nexus.example.com:8089

(Note the leading comma in the "expected" value. It seems that this CLI argument is being parsed incorrectly?)

Changing nexus.example.com:8089 to https://nexus.example.com:8089 makes it work again.

Expected Behavior

Expected allowed-hosts not to require a scheme.

Current Behavior

When using a port in an allowed-host, it doesn't work unless you use a scheme as well. And if that's a feature not a bug, then the error message could be improved.

Your Environment

lirantal commented 4 years ago

FYI you can debug from the CLI via:

DEBUG=lockfile* lockfile-lint --path yarn.lock ...

It'll show you what has been parsed and a bit more details.

lirantal commented 4 years ago

Looked into it quickly, and believe I see the issue. Thanks for raising this. I'll push a fix and happy if you can confirm it too.

lirantal commented 4 years ago

@matthias-ccri should be fixed by PR #94 and a version will be released soon. It would be greatly appreciated if you could use the latest version and let me know if the issue is fixed.

lirantal commented 4 years ago

Fixed in the latest version. Thanks for reporting @matthias-ccri ❤️

matthias-ccri commented 4 years ago

Thanks! Sorry, I wasn't able to figure out how to npx from a git repo. Thanks again for the fix.

lirantal commented 4 years ago

Many many thanks to you @matthias-ccri for taking the time to report it. Appreciate it, and happy to have pushed that fix ❤️