Unverified Commit a9c94419 authored by Sandro Jäckel's avatar Sandro Jäckel
Browse files

fetch-yarn-deps: fix "Incomplete URL substring sanitization" 

'https://codeload.github.com' may be followed by an arbitrary host name.
parent 0b3aa5bd

pkgs/build-support/node/fetch-yarn-deps/fixup.js

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ const fixupYarnLock = async (lockContents, verbose) => { 
			}

			const [ url, hash ] = pkg.resolved.split("#", 2)



			if (hash || url.startsWith("https://codeload.github.com")) {

			if (hash || url.startsWith("https://codeload.github.com/")) {

				if (verbose) console.log(`Removing integrity for git dependency ${dep}`)

				delete pkg.integrity

			}