fetch-yarn-deps: follow relative redirects

This commit is contained in:
Alexander Sieg 2025-08-11 16:41:19 +02:00
parent 43a602c25d
commit 2323653633
No known key found for this signature in database

View File

@ -10,6 +10,7 @@ const path = require('path')
const lockfile = require('./yarnpkg-lockfile.js')
const { promisify } = require('util')
const url = require('url')
const { URL } = url;
const { urlToName } = require('./common.js')
const execFile = promisify(child_process.execFile)
@ -20,7 +21,7 @@ const exec = async (...args) => {
return res
}
const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1') => {
return new Promise((resolve, reject) => {
const get = (url, redirects = 0) => https.get(url, (res) => {
if(redirects > 10) {
@ -28,7 +29,9 @@ const downloadFileHttps = (fileName, url, expectedHash, hashType = 'sha1') => {
return;
}
if(res.statusCode === 301 || res.statusCode === 302) {
return get(res.headers.location, redirects + 1)
const location = new URL(res.headers.location, url);
if (verbose) console.log('following redirect to ' + location);
return get(location, redirects + 1);
}
const file = fs.createWriteStream(fileName)
const hash = crypto.createHash(hashType)
@ -119,9 +122,9 @@ const downloadPkg = (pkg, verbose) => {
} else if (url.startsWith('https://')) {
if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
const [ type, checksum ] = pkg.integrity.split('-')
return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), type)
return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type)
}
return downloadFileHttps(fileName, url, hash)
return downloadFileHttps(fileName, url, hash, verbose)
} else if (url.startsWith('file:')) {
console.warn(`ignoring unsupported file:path url "${url}"`)
} else {