fix: reject loose ranges that collapse to match everything
In loose mode the comparators that fail to parse are filtered out of a comparator list, and whatever is left becomes the range. When the only survivor is the any comparator, a typo such as `* (4.1.x 4.1.2)` drops `(4.1.x` and `4.1.2)` and collapses to the leftover `*`, so the range silently satisfies every version instead of being rejected. Without `loose` the same input throws `Invalid comparator: (4.1.x`. Treat that comparator list as invalid instead, the same way a list with no valid comparator at all is already treated: the list is dropped, so other `||` branches still stand on their own and a range left with no valid branch throws `Invalid SemVer Range`. Junk sitting next to a comparator that does parse is still tolerated, so `>=1.2.3 &&&` still yields `>=1.2.3` and `== 1.0.0` still yields `1.0.0`. Fixes #387
This commit is contained in:
1 parent
d4354cc38b
commit
2124e4b155
3 files changed
+37
-1
No files matched your search
Vendored
+8
@@ -148,4 +148,12 @@ module.exports = [
|
||||
['1.2.3+sha256.' + 'a'.repeat(200) + '.' + 'b'.repeat(200), '1.2.3', { loose: true }],
|
||||
['1.2.3+' + 'a'.repeat(251) + ' || 2.0.0+' + 'b'.repeat(251),
|
||||
'1.2.3||2.0.0', { loose: true }],
|
||||
// dropping unparseable comparators must not leave a match-everything range
|
||||
['* (4.1.x 4.1.2)', null],
|
||||
['* (4.1.x 4.1.2)', null, { loose: true }],
|
||||
['* (foo)', null, { loose: true }],
|
||||
// but loose mode still tolerates junk next to a real comparator, and still
|
||||
// tolerates a `||` branch that is invalid as a whole
|
||||
['>=1.2.3 &&&', '>=1.2.3', { loose: true }],
|
||||
['1.2.3 || (foo)', '1.2.3', { loose: true }],
|
||||
]
|
||||
Reference in new issue
Block a user