lab: a forge setting that is not http(s) is never a trusted origin (hq issue 624, review 222)

2026-10-13 20:33:13 +02:00
parent 6f7d06726c
commit 1faee6e279
2 changed files with 14 additions and 1 deletions
@@ -126,7 +126,9 @@ export async function npmRegistry(forge: string, get: typeof fetch = fetch, publ
  } catch {
    return fallback(`the forge ${JSON.stringify(forge)} is not a URL`);
  }
-  const trusted = [own.origin];
+  // The forge setting's own origin is trusted only as an http(s) one: any other scheme's origin is
+  // "null", or names no registry npm would fetch from.
+  const trusted = own.protocol === "https:" || own.protocol === "http:" ? [own.origin] : [];
  if (publicRoot) {
    try {
      trusted.unshift(new URL(publicRoot).origin);