fix(logging): sanitize logged argv · npm/cli@487731c (original) (raw)

File tree

4 files changed

lines changed

4 files changed

lines changed

Original file line number Diff line number Diff line change
@@ -27,7 +27,8 @@ module.exports = async (process) => {
27 27 if (process.argv[1][process.argv[1].length - 1] === 'g')
28 28 process.argv.splice(1, 1, 'npm', '-g')
29 29
30 -log.verbose('cli', process.argv)
30 +const replaceInfo = require('../lib/utils/replace-info.js')
31 +log.verbose('cli', replaceInfo(process.argv))
31 32
32 33 log.info('using', 'npm@%s', npm.version)
33 34 log.info('using', 'node@%s', process.version)
Original file line number Diff line number Diff line change
@@ -109,9 +109,7 @@ module.exports = (er, npm) => {
109 109 [
110 110 'Merge conflict detected in your package.json.',
111 111 '',
112 -'Please resolve the package.json conflict and retry the command:',
113 -'',
114 -`$ ${process.argv.join(' ')}`,
112 +'Please resolve the package.json conflict and retry.',
115 113 ].join('\n'),
116 114 ])
117 115 break
Original file line number Diff line number Diff line change
@@ -1537,9 +1537,7 @@ Object {
1537 1537 String(
1538 1538 Merge conflict detected in your package.json.
1539 1539
1540 - Please resolve the package.json conflict and retry the command:
1541 -
1542 - $ arg v
1540 + Please resolve the package.json conflict and retry.
1543 1541 ),
1544 1542 ],
1545 1543 ],
Original file line number Diff line number Diff line change
@@ -104,6 +104,32 @@ t.test('calling with --versions calls npm version with no args', async t => {
104 104 t.strictSame(exitHandlerCalled, [])
105 105 })
106 106
107 +t.test('logged argv is sanitized', async t => {
108 +const proc = processMock({
109 +argv: ['node', 'npm', 'testcommand', 'https://username:password@npmjs.org/test\_url\_with\_a\_password'\],
110 +})
111 +const { npm } = mockNpm(t)
112 +const cli = cliMock(npm)
113 +
114 +npm.commands.testcommand = (args, cb) => {
115 +cb()
116 +}
117 +
118 +await cli(proc)
119 +t.equal(proc.title, 'npm')
120 +t.strictSame(logs, [
121 +'pause',
122 +['verbose', 'cli', [
123 +'node',
124 +'npm',
125 +'testcommand',
126 +'https://username:\*\*\*@npmjs.org/test\_url\_with\_a\_password',
127 +]],
128 +['info', 'using', 'npm@%s', npm.version],
129 +['info', 'using', 'node@%s', process.version],
130 +])
131 +})
132 +
107 133 t.test('print usage if no params provided', async t => {
108 134 const proc = processMock({
109 135 argv: ['node', 'npm'],