renovate/lib/util/url.ts

import {
  isArray,
  isNonEmptyString,
  isString,
  isUrlInstance,
} from '@sindresorhus/is';
// oxlint-disable-next-line no-restricted-imports
import _parseLinkHeader from 'parse-link-header';
import urlJoin from 'url-join';
import { logger } from '../logger/index.ts';
import { regEx } from './regex.ts';

export function joinUrlParts(...parts: string[]): string {
  return urlJoin(...parts);
}

export function ensurePathPrefix(url: string, prefix: string): string {
  const parsed = new URL(url);
  const fullPath = parsed.pathname + parsed.search;
  if (fullPath.startsWith(prefix)) {
    return url;
  }
  return parsed.origin + prefix + fullPath;
}

export function ensureTrailingSlash(url: string): string {
  return url.replace(regEx(/\/?$/), '/');
}

export function trimTrailingSlash(url: string): string {
  return url.replace(regEx(/\/+$/), '');
}

export function trimLeadingSlash(path: string): string {
  return path.replace(regEx(/^\/+/), '');
}

export function trimSlashes(path: string): string {
  return trimLeadingSlash(trimTrailingSlash(path));
}

/**
 * Resolves an input path against a base URL
 *
 * @param baseUrl - base URL to resolve against
 * @param input - input path (if this is a full URL, it will be returned)
 */
export function resolveBaseUrl(baseUrl: string, input: string | URL): string {
  const inputString = input.toString();

  let host;
  let pathname;
  try {
    ({ host, pathname } = new URL(inputString));
  } catch {
    pathname = inputString;
  }

  return host ? inputString : urlJoin(baseUrl, pathname || '');
}

/**
 * Replaces the path of a URL with a new path
 *
 * @param baseUrl - source URL
 * @param path - replacement path (if this is a full URL, it will be returned)
 */
export function replaceUrlPath(baseUrl: string | URL, path: string): string {
  if (parseUrl(path)) {
    return path;
  }

  const { origin } = isString(baseUrl) ? new URL(baseUrl) : baseUrl;
  return urlJoin(origin, path);
}

/**
 * Resolves a server-provided pagination "next" URL against the current request
 * URL, returning it only when it stays on the same origin.
 *
 * Registries paginate by returning a `Link` header (or Atom `<link rel="next">`)
 * pointing at the next page.
 *
 * However, if we were to follow that URL without validating it, this could lead to us being redirected to a different host, which could lead to Server-Side Request Forgery (SSRF).
 *
 * This guard drops any `next` URL that resolves to a different origin.
 *
 * @param baseUrl - the URL of the request that produced `nextUrl`
 * @param nextUrl - the remote-server-provided pagination target (may be relative, and may be malicious)
 * @returns the resolved absolute URL if same-origin, otherwise `null`
 */
export function resolveSameOriginUrl(
  baseUrl: string | URL,
  nextUrl: string | URL,
): string | null {
  const base = parseUrl(baseUrl);
  if (!base) {
    return null;
  }

  let resolved: URL;
  try {
    resolved = new URL(nextUrl.toString(), base);
  } catch {
    return null;
  }

  // If the base URL is HTTPS and the resolved URL is HTTP, but has no port specified, we can assume that the server intended to use HTTPS. This is a common misconfiguration in some registries.
  if (
    base.protocol === 'https:' &&
    resolved.protocol === 'http:' &&
    resolved.port === ''
  ) {
    logger.debug(`Detected protocol downgrade and fixed it: ${resolved.href}`);
    resolved.protocol = 'https:';
  }

  return resolved.origin === base.origin ? resolved.href : null;
}

export function getQueryString(params: Record<string, any>): string {
  const usp = new URLSearchParams();
  for (const [k, v] of Object.entries(params)) {
    if (isArray<object>(v)) {
      for (const item of v) {
        // TODO: fix me?
        // oxlint-disable-next-line typescript/no-base-to-string
        usp.append(k, item.toString());
      }
    } else {
      usp.append(k, v.toString());
    }
  }
  return usp.toString();
}

export function isHttpUrl(url: unknown): boolean {
  if (!isNonEmptyString(url) && !isUrlInstance(url)) {
    return false;
  }
  const protocol = parseUrl(url)?.protocol;
  return protocol === 'https:' || protocol === 'http:';
}

export function parseUrl(url: URL | string | undefined | null): URL | null {
  if (!url) {
    return null;
  }

  if (url instanceof URL) {
    return url;
  }

  try {
    return new URL(url);
  } catch {
    return null;
  }
}

/**
 * Tries to create an URL object from either a full URL string or a hostname
 * @param url either the full url or a hostname
 * @returns an URL object or null
 */
export function createURLFromHostOrURL(url: string): URL | null {
  return parseUrl(url) ?? parseUrl(`https://${url}`);
}

/**
 * Removes the `user:password@` userinfo from a URL.
 *
 * Registries are sometimes configured with a URL that carries a placeholder such as `${USER}:${PASS}@`, and credentials embedded this way should not stop the URL from matching a plain `matchHost`.
 *
 * @returns the URL's `href` without userinfo, or `null` if `url` cannot be parsed
 */
export function stripUrlCredentials(url: URL): string;
export function stripUrlCredentials(url: string | URL): string | null;
export function stripUrlCredentials(url: string | URL): string | null {
  const parsed = parseUrl(url);
  if (!parsed) {
    return null;
  }
  if (!parsed.username && !parsed.password) {
    return parsed.href;
  }
  // clone rather than mutate: `parseUrl` returns the same instance it was given when `url` is already a `URL`
  const stripped = new URL(parsed.href);
  stripped.username = '';
  stripped.password = '';
  return stripped.href;
}

export type LinkHeaderLinks = _parseLinkHeader.Links;

export function parseLinkHeader(
  linkHeader: string | null | undefined,
): LinkHeaderLinks | null {
  if (!isNonEmptyString(linkHeader)) {
    return null;
  }
  if (linkHeader.length > 2000) {
    logger.warn({ linkHeader }, 'Link header too long.');
    return null;
  }
  return _parseLinkHeader(linkHeader);
}

/**
 * prefix https:// to hosts with port or path
 */
export function massageHostUrl(url: string): string {
  if (!url.includes('://') && url.includes('/')) {
    return `https://${url}`;
  }
  if (!url.includes('://') && url.includes(':')) {
    return `https://${url}`;
  }
  return url;
}