fix proxy mode failing for GH private packages (#137)

* fix proxy mode failing for GH private packages

* skip analysis for private packages for proxy mode

* introduce npmRegistryConfig and support for handling multiple parsers in future

* refactor name and unexport npm config functions

* rm unused function

* rename & unexport npmRegistryURLParser

* add e2e for malicious pkg blocked using proxy mode
This commit is contained in:
Sahil Bansal
2026-01-23 18:38:54 +05:30
committed by GitHub
parent aa5c528a9d
commit 0aa82033a5
6 changed files with 207 additions and 14 deletions
+70 -1
View File
@@ -265,7 +265,8 @@ func TestParseNpmRegistryURL(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
got, err := parseNpmRegistryURL(tt.urlPath)
parser := npmParser{}
got, err := parser.ParseURL(tt.urlPath)
if tt.wantErr {
assert.Error(t, err)
@@ -280,3 +281,71 @@ func TestParseNpmRegistryURL(t *testing.T) {
})
}
}
func TestGithubParser_ParseURL(t *testing.T) {
tests := []struct {
name string
urlPath string
wantIsTarball bool
wantErr bool
}{
{
name: "github metadata request",
urlPath: "/@owner/package",
wantIsTarball: false,
wantErr: false,
},
{
name: "github download request",
urlPath: "/download/@owner/package/1.0.0/abc123.tgz",
wantIsTarball: false,
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
parser := githubParser{}
got, err := parser.ParseURL(tt.urlPath)
if tt.wantErr {
assert.Error(t, err)
return
}
assert.NoError(t, err)
assert.Equal(t, tt.wantIsTarball, got.IsTarball)
})
}
}
func TestGithubBlobParser_ParseURL(t *testing.T) {
tests := []struct {
name string
urlPath string
wantIsTarball bool
wantErr bool
}{
{
name: "github blob storage request",
urlPath: "/npmregistryv2prod/blobs/132160241/gh-npm-pkg/1.0.0/abc123",
wantIsTarball: false,
wantErr: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
parser := githubBlobParser{}
got, err := parser.ParseURL(tt.urlPath)
if tt.wantErr {
assert.Error(t, err)
return
}
assert.NoError(t, err)
assert.Equal(t, tt.wantIsTarball, got.IsTarball)
})
}
}