npm: avoid invalid lookups

aeschli · aeschli · commit 88664e267a5e · 2020-08-24T16:58:36.000+02:00
diff --git a/extensions/npm/src/features/packageJSONContribution.ts b/extensions/npm/src/features/packageJSONContribution.ts
@@ -249,7 +249,27 @@ export class PackageJSONContribution implements IJSONContribution {
 		return null;
 	}
 
+	private isValidNPMName(name: string): boolean {
+		// following rules from https://github.com/npm/validate-npm-package-name
+		if (!name || name.length > 214 || name.match(/^[_.]/)) {
+			return false;
+		}
+		const match = name.match(/^(?:@([^/]+?)[/])?([^/]+?)$/);
+		if (match) {
+			const scope = match[1];
+			if (scope && encodeURIComponent(scope) !== scope) {
+				return false;
+			}
+			const name = match[2];
+			return encodeURIComponent(name) === name;
+		}
+		return true;
+	}
+
 	private async fetchPackageInfo(pack: string): Promise<ViewPackageInfo | undefined> {
+		if (!this.isValidNPMName(pack)) {
+			return undefined; // avoid unnecessary lookups
+		}
 		let info: ViewPackageInfo | undefined;
 		if (this.canRunNPM) {
 			info = await this.npmView(pack);
@@ -260,7 +280,6 @@ export class PackageJSONContribution implements IJSONContribution {
 		return info;
 	}
 
-
 	private npmView(pack: string): Promise<ViewPackageInfo | undefined> {
 		return new Promise((resolve, _reject) => {
 			const command = 'npm view --json ' + pack + ' description dist-tags.latest homepage version';
