deps: update npm to 7.0.0-rc.3

PR-URL: https://github.com/nodejs/node/pull/35474
Reviewed-By: Ruy Adorno <ruyadorno@github.com>
Reviewed-By: Ujjwal Sharma <ryzokuken@disroot.org>
Reviewed-By: Ben Coe <bencoe@gmail.com>
Reviewed-By: Geoffrey Booth <webmaster@geoffreybooth.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

1 files changed, 18 insertions, 5 deletions

diff --git a/deps/npm/lib/utils/open-url.js b/deps/npm/lib/utils/open-url.js
index e1ed2b3fab..8f270221cd 100644
--- a/deps/npm/lib/utils/open-url.js
+++ b/deps/npm/lib/utils/open-url.js
@@ -3,6 +3,16 @@ const npm = require('../npm.js')
 const output = require('./output.js')
 const opener = require('opener')
 
+const { URL } = require('url')
+
+const isUrlValid = url => {
+  try {
+    return /^(https?|file):$/.test(new URL(url).protocol)
+  } catch (_) {
+    return false
+  }
+}
+
 // attempt to open URL in web-browser, print address otherwise:
 module.exports = function open (url, errMsg, cb, browser = npm.config.get('browser')) {
   function printAlternateMsg () {
@@ -12,19 +22,22 @@ module.exports = function open (url, errMsg, cb, browser = npm.config.get('brows
         title: errMsg,
         url
       }, null, 2)
-      : `${errMsg}:\n\n${url}`
+      : `${errMsg}:\n  ${url}\n`
 
     output(alternateMsg)
   }
 
-  const skipBrowser = process.argv.indexOf('--no-browser') > -1
-
-  if (skipBrowser) {
+  if (browser === false) {
     printAlternateMsg()
     return cb()
   }
 
-  opener(url, { command: browser }, (er) => {
+  if (!isUrlValid(url)) {
+    return cb(new Error('Invalid URL: ' + url))
+  }
+
+  const command = browser === true ? null : browser
+  opener(url, { command }, (er) => {
     if (er && er.code === 'ENOENT') {
       printAlternateMsg()
       return cb()