fix: sanitize dir names in the store (#4726)

close #4716
pnpm · May 13, 2022 · c576955 · c576955
1 parent fe06f7d
commit c576955
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/.changeset/hot-hairs-thank.md b/.changeset/hot-hairs-thank.md
@@ -0,0 +1,6 @@
+---
+"dependency-path": patch
+"pnpm": patch
+---
+
+Sanitize the directory names created inside `node_modules/.pnpm` and inside the global store [#4716](https://github.com/pnpm/pnpm/issues/4716)
diff --git a/packages/dependency-path/src/index.ts b/packages/dependency-path/src/index.ts
@@ -131,7 +131,7 @@ export function parse (dependencyPath: string) {
 }
 
 export function depPathToFilename (depPath: string) {
-  const filename = depPathToFilenameUnescaped(depPath).replace(/\//g, '+')
+  const filename = depPathToFilenameUnescaped(depPath).replace(/[\\/:*?"<>|]/g, '+')
   if (filename.length > 120 || filename !== filename.toLowerCase() && !filename.startsWith('file+')) {
     return `${filename.substring(0, 50)}_${createBase32Hash(filename)}`
   }

diff --git a/packages/dependency-path/test/index.ts b/packages/dependency-path/test/index.ts
@@ -130,7 +130,8 @@ test('resolve()', () => {
 test('depPathToFilename()', () => {
   expect(depPathToFilename('/foo/1.0.0')).toBe('foo@1.0.0')
   expect(depPathToFilename('/@foo/bar/1.0.0')).toBe('@foo+bar@1.0.0')
-  expect(depPathToFilename('github.com/something/foo/0000')).toBe('github.com+something+foo@0000')
+  expect(depPathToFilename('github.com/something/foo/0000?v=1')).toBe('github.com+something+foo@0000+v=1')
+  expect(depPathToFilename('\\//:*?"<>|')).toBe('++@+++++++')
 
   const filename = depPathToFilename('file:test/foo-1.0.0.tgz_foo@2.0.0')
   expect(filename).toBe('file+test+foo-1.0.0.tgz_foo@2.0.0')