Khải
62236cb424
Harden the web-based authentication flow against a malicious or compromised registry, in both @pnpm/network.web-auth and its pacquet port. Bound the token poll: cap the token response body read from the registry-supplied "done" URL at 64 KiB, and do not read the body of non-OK or still-pending (HTTP 202) responses at all, so a registry cannot grow pnpm's memory through the poll loop. Make a failed QR code non-fatal: when a QR code cannot be generated (for example when the authentication URL exceeds the maximum QR data capacity), warn and display the URL on its own instead of aborting authentication. Resolves pnpm/pnpm#12721.
376 B
376 B
@pnpm/network.web-auth, @pnpm/auth.commands, pnpm, pacquet
| @pnpm/network.web-auth | @pnpm/auth.commands | pnpm | pacquet |
|---|---|---|---|
| minor | patch | patch | patch |
When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.