Repository navigation
fix(analyzer): compare hostname when matching npm trusted registry URLs - #760
Merged
abhisek merged 3 commits intoJul 30, 2026
Merged
Conversation
npmIsTrustedSource compared the trusted URL's `Host` (which includes the port) against the resolved URL's `Hostname()` (which does not). Any trusted registry URL configured with an explicit port could therefore never match, and the dedicated port comparison a few lines below was unreachable. Effect: users pointing `trusted_registry_urls` at a self-hosted registry on a non-default port (e.g. https://registry.internal:8443) had every single package in package-lock.json reported as "resolved to an untrusted host", making the lockfile poisoning analyzer unusable for those setups. Compare `Hostname()` on both sides and let the existing port check handle the port. Adds test cases for matching port, mismatched port, missing port, and port plus base path. Signed-off-by: Yuvraj singh <yuvrajsinghrock1221@gmail.com>
SafeDep Report Summary
No dependency changes detected. Nothing to scan. This report is generated by SafeDep Github App |
abhisek
approved these changes
Jul 30, 2026
abhisek
enabled auto-merge (squash)
July 30, 2026 13:26
Contributor
Author
|
Looks like the run-e2e / run-test workflows are waiting on maintainer approval. Happy to wait, just flagging in case it slipped by. @abhisek @KunalSin9h @sudhanshutech |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #759
npmIsTrustedSourcecompared the trusted URL'sHost(port included) against the resolved URL'sHostname()(port stripped), so any trusted registry URL configured with an explicit port could never match — and the dedicated port comparison below it was unreachable.This compares
Hostname()on both sides and lets the existing port check do its job.Tests: adds cases for matching port, mismatched port, trusted-has-port/source-doesn't, and port + base path.
go test ./pkg/analyzer/...passes andgo vet ./...is clean.