yarnpkg/CVE-2025-8262.patch

15 lines
669 B
Diff

diff -rupN --no-dereference yarn-1.22.22/src/resolvers/exotics/hosted-git-resolver.js yarn-1.22.22-new/src/resolvers/exotics/hosted-git-resolver.js
--- yarn-1.22.22/src/resolvers/exotics/hosted-git-resolver.js 2024-03-09 22:33:28.000000000 +0100
+++ yarn-1.22.22-new/src/resolvers/exotics/hosted-git-resolver.js 2025-07-31 00:36:53.007366080 +0200
@@ -30,8 +30,9 @@ export function explodeHostedGitFragment
}
const parts = fragment
- .replace(/(.*?)#.*/, '$1') // Strip hash
- .replace(/.*:(.*)/, '$1') // Strip prefixed protocols
+ .split('#', 1)[0]
+ .split(':')
+ .pop()
.replace(/.git$/, '') // Strip the .git suffix
.split('/');