Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Hosted yarn berry redirect makes yarn send the project's npm registry auth token to the patch host

Offen
  • Stimmt etwas nicht?
#404 3 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
54/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
javascript, rust
Bereich
cli, documentation, security

Rechercherichtung

Start with preflight_yarn_berry_hosted and rewrite_yarn_berry in crates/socket-patch-core/src/patch/redirect/mod.rs, then review CLI_CONTRACT.md and the supplied cold-cache Yarn Berry reproduction. Compare scoped, unscoped, environment-token, and npmAlwaysAuth cases; done means hosted patch requests do not silently receive registry credentials, with the relevant behavior documented in docs/ecosystems.md and docs/testing/yarn-berry-compatibility.md.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

agent:claimed agent:triaged bug bughunt pm:yarn-berry priority:p1

[agent] Found by the scheduled Yarn Berry (2+) bug-hunt routine (ledger #305).

Summary

On yarn berry, hosted mode pins a patched dependency as <name>@npm:<v>::__archiveUrl=<hosted tgz> (crates/socket-patch-core/src/patch/redirect/mod.rs:3459). Yarn handles that locator with its npm fetcher, so it attaches the npm registry's credentials to the request, even though the request goes to the hosted patch server and not to the registry. These cases all send Authorization: Bearer <npm token> to the patch host:

  • any scoped package (@scope/name) when an npmAuthToken is configured. Yarn uses best-effort auth for scoped idents, so npmAlwaysAuth isn't needed. That covers the top-level npmAuthToken in .yarnrc.yml, the YARN_NPM_AUTH_TOKEN env var that CI commonly sets, and npmScopes.<scope>.npmAuthToken;
  • every hosted package, scoped or not, when npmAlwaysAuth: true is set. That's the usual setup for Artifactory / Nexus / GitHub Packages proxies.

Impact

  • A private-registry or npm publish token is disclosed to patch.socket.dev (or to any --patch-server-url host) on every cold-cache install of a hosted-patched package. CI is affected on every run. The user never configured that host to receive the token, and nothing in the docs mentions it.
  • npm, pnpm and yarn classic scope registry auth to the registry's host, so this is berry-specific. It comes from the locator form that hosted mode picks.
  • Scoped packages (@babel/*, @types/*, @isaacs/* …) are a large share of the patchable npm surface.

Repro (Linux, yarn 4.12.0 / 4.18.1 / 4.0.2; mock patch API logging the Authorization header on the tarball route)

mkdir proj && cd proj
echo '{"name":"app","version":"1.0.0","private":true,"dependencies":{"@isaacs/string-locale-compare":"1.1.0","left-pad":"1.3.0"}}' > package.json
printf 'nodeLinker: node-modules\nenableGlobalCache: false\n' > .yarnrc.yml
yarn install
socket-patch scan --json --yes --api-url http://127.0.0.1:18080 --org test-org --api-token fake   # hosted (default): redirected 2
# fresh checkout, cold cache:
mkdir ../fresh && cp package.json yarn.lock ../fresh/ && cd ../fresh
printf 'nodeLinker: node-modules\nenableGlobalCache: false\nunsafeHttpWhitelist:\n  - "127.0.0.1"\n' > .yarnrc.yml
YARN_NPM_AUTH_TOKEN=ENV-CI-TOKEN YARN_GLOBAL_FOLDER=$(mktemp -d) yarn install --immutable

What the patch host received:

GET /patch/npm/@isaacs/string-locale-compare/1.1.0/<token>/<uuid>/…tgz   Authorization: Bearer ENV-CI-TOKEN
GET /patch/npm/left-pad/1.3.0/<token>/<uuid>/left-pad-1.3.0.tgz          Authorization: (none)

With npmAuthToken: "ALWAYS-TOKEN" and npmAlwaysAuth: true in .yarnrc.yml, both requests carry Bearer ALWAYS-TOKEN. The installs themselves succeed and get the patched bytes.

Expected vs actual

  • Expected: a hosted redirect shouldn't cause installs to disclose registry credentials to a host the user never set up for them. The CLI contract already holds hosted fetches to this standard elsewhere: the vlt artifact probe is specified as "no Authorization" (CLI_CONTRACT.md, redirect_vlt_artifact_unverifiable). If the berry locator form can't avoid it, hosted mode should at least detect a configured npmAuthToken / npmAlwaysAuth (.yarnrc.yml, env) and warn or refuse, and docs/ecosystems.md "yarn berry" plus docs/testing/yarn-berry-compatibility.md should document it.
  • Actual: the token is sent silently, and the run reports plain success.

Matrix

OS yarn scoped + npmAuthToken / YARN_NPM_AUTH_TOKEN scoped + npmScopes token unscoped + npmAuthToken any + npmAlwaysAuth: true
Linux 4.0.2 (bare-hex lock) sent (env) untested — untested
Linux 4.12.0 sent untested not sent sent
Linux 4.18.1 (lock version: 10) sent (rc and env) sent not sent sent
macOS / Windows — untested. The behaviour is in yarn's JS fetcher (npmHttpUtils.get takes auth from the configured registry, not from the URL origin), so it shouldn't depend on the OS

Yarn 2/3 aren't reachable: hosted mode refuses cacheKey 7/8.

First bad: main 2463257. Release 4.0.0 writes the same ::__archiveUrl= locator for berry, so it should behave the same; I didn't re-run the token capture against it.

Suspect code

  • crates/socket-patch-core/src/patch/redirect/mod.rs:3459: the {fname}@npm:{}::__archiveUrl={} resolution written by rewrite_yarn_berry (line 3238). There's no gate on registry auth config next to the other berry project gates in preflight_yarn_berry_hosted (around line 3195).
Vorherrschende Sprache
Rust
Sterne
8
Forks
0
Ø Merge
18 Std. 4 Min.
Gemergte PRs (30 T.)
70

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-patch

Alle Issues in SocketDev/socket-patch

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.