From 2e876d12a67f2778c382dd29edc5ecc150279975 Mon Sep 17 00:00:00 2001 From: Ahmed Walid Elhakim <53128020+ahmedwelhakim@users.noreply.github.com> Date: Tue, 4 Oct 2022 18:04:03 +0200 Subject: [PATCH] fix: properly handle missing algorithm type (#48) Fixing a bug that happen in npm cli when I install a library. in Line 272 the result of parse can be null if integrity is null. Then in line 273 other is null so it breaks as below: ``` TypeError: Cannot read properties of null (reading 'pickAlgorithm') npm verb stack at Integrity.match (/usr/lib/node_modules/npm/node_modules/ssri/lib/index.js:273:24) npm verb stack at CachePolicy.satisfies (/usr/lib/node_modules/npm/node_modules/make-fetch-happen/lib/cache/policy.js:112:49) npm verb stack at Function.find (/usr/lib/node_modules/npm/node_modules/make-fetch-happen/lib/cache/entry.js:178:25) npm verb stack at async cacheFetch (/usr/lib/node_modules/npm/node_modules/make-fetch-happen/lib/cache/index.js:8:17) npm verb stack at async fetch (/usr/lib/node_modules/npm/node_modules/make-fetch-happen/lib/fetch.js:98:7) ``` --- lib/index.js | 3 +++ test/integrity.js | 1 + 2 files changed, 4 insertions(+) diff --git a/lib/index.js b/lib/index.js index 1443137..222861a 100644 --- a/lib/index.js +++ b/lib/index.js @@ -270,6 +270,9 @@ class Integrity { match (integrity, opts) { opts = ssriOpts(opts) const other = parse(integrity, opts) + if (!other) { + return false + } const algo = other.pickAlgorithm(opts) return ( this[algo] && diff --git a/test/integrity.js b/test/integrity.js index 1bc86c6..acd0a1e 100644 --- a/test/integrity.js +++ b/test/integrity.js @@ -108,6 +108,7 @@ test('match()', t => { }, 'returns the strongest match') t.notOk(sri.match('sha512-foo'), 'falsy when match fails') t.notOk(sri.match('sha384-foo'), 'falsy when match fails') + t.notOk(sri.match(null), 'falsy when integrity is null') t.end() })