Wrap new URL() in a try-catch

renovatebot · Sep 7, 2024 · f2754db · f2754db
1 parent e71b81a
commit f2754db
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 1 deletion.
diff --git a/lib/modules/datasource/pypi/index.spec.ts b/lib/modules/datasource/pypi/index.spec.ts
@@ -732,6 +732,18 @@ describe('modules/datasource/pypi/index', () => {
     expect(googleAuth).toHaveBeenCalledTimes(1);
   });
 
+  it('ignores an invalid URL when checking for auth headers', async () => {
+    const config = {
+      registryUrls: ['not-a-url/simple/'],
+    };
+    const res = await getPkgReleases({
+      ...config,
+      datasource,
+      packageName: 'azure-cli-monitor',
+    });
+    expect(res?.releases.pop()).toBeNil();
+  });
+
   it('uses https://pypi.org/pypi/ instead of https://pypi.org/simple/', async () => {
     httpMock.scope(baseUrl).get('/azure-cli-monitor/json').reply(200, res1);
     const config = {

diff --git a/lib/modules/datasource/pypi/index.ts b/lib/modules/datasource/pypi/index.ts
@@ -89,7 +89,13 @@ export class PypiDatasource extends Datasource {
   private async getAuthHeaders(
     lookupUrl: string,
   ): Promise<OutgoingHttpHeaders> {
-    const url = new URL(lookupUrl);
+    let url: URL
+    try {
+      url = new URL(lookupUrl);
+    } catch (err) {
+      logger.once.debug({ lookupUrl, err }, 'Failed to parse URL');
+      return {}
+    }
     if (url.hostname.endsWith(googleArtifactRegistryDomain)) {
       const auth = await getGoogleAuthToken();
       if (auth) {