fix: prevent adding invalid dist-tag (#7195)

npm · Feb 1, 2024 · b0a3ba0 · b0a3ba0
1 parent 5b7184f
commit b0a3ba0
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/lib/commands/dist-tag.js b/lib/commands/dist-tag.js
@@ -89,6 +89,9 @@ class DistTag extends BaseCommand {
 
     log.verbose('dist-tag add', defaultTag, 'to', spec.name + '@' + version)
 
+    // make sure new spec with tag is valid, this will throw if invalid
+    npa(`${spec.name}@${defaultTag}`)
+
     if (!spec.name || !version || !defaultTag) {
       throw this.usageError('must provide a spec with a name and version, and a tag to add')
     }

diff --git a/test/lib/commands/dist-tag.js b/test/lib/commands/dist-tag.js
@@ -318,6 +318,15 @@ t.test('add missing pkg name', async t => {
   )
 })
 
+t.test('add invalid tag', async t => {
+  const { distTag } = await mockDist(t)
+  await t.rejects(
+    distTag.exec(['add', '@tag']),
+    { code: 'EINVALIDTAGNAME' },
+    'should exit with invalid tag name error'
+  )
+})
+
 t.test('set existing version', async t => {
   const { distTag, logs } = await mockDist(t)
   await distTag.exec(['set', '@scoped/[email protected]', 'b'])