File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -63,24 +63,34 @@ export function getHexFromDigest(digest: GitHubDigest): string {
6363 * Latest: https://github.com/oven-sh/bun/releases/latest/download/bun-darwin-aarch64.zip
6464 */
6565export function parseAssetUrl ( downloadUrl : string ) : UrlAssetMetadata {
66- const url = new URL ( downloadUrl ) ;
66+ const urlObj = new URL ( downloadUrl ) ;
67+ if ( "github.com" !== urlObj . hostname ) {
68+ throw new Error ( `Expected a github.com URL, got: ${ url . hostname } ` ) ;
69+ }
70+
6771 // Remove leading slash so index 0 is 'owner'
68- const parts = url . pathname . slice ( 1 ) . split ( "/" ) ;
72+ const parts = urlObj . pathname . slice ( 1 ) . split ( "/" ) ;
73+ if ( parts . length < 6 ) {
74+ throw new Error ( `Unsupported GitHub asset URL format: ${ downloadUrl } ` ) ;
75+ }
76+
77+ const expectedStructure =
78+ "releases" === parts [ 2 ] &&
79+ ( "latest" === parts [ 3 ] || "download" === parts [ 3 ] ) ;
6980
7081 const owner = parts [ 0 ] ;
7182 const repo = parts [ 1 ] ;
7283 let tag = parts [ 4 ] ;
7384 const name = parts [ 5 ] ;
7485
75- if ( ! owner || ! repo || ! tag || ! name ) {
86+ if ( ! expectedStructure || ! owner || ! repo || ! tag || ! name ) {
7687 throw new Error (
7788 `Failed to parse GitHub asset metadata from: ${ downloadUrl } ` ,
7889 ) ;
7990 }
8091
81- let latest = false ;
82- if ( "latest" === parts [ 3 ] && "download" === tag ) {
83- latest = true ;
92+ const latest = "latest" === parts [ 3 ] && "download" === tag ;
93+ if ( latest ) {
8494 tag = "" ;
8595 }
8696
You can’t perform that action at this time.
0 commit comments