fix(install): do not install invalid package name

ruyadorno · lukekarrys · commit b06e89f434fe · 2022-04-19T16:28:18.000-07:00
Throws an usage error if finding an invalid argument in global install. Fixes: #3029
diff --git a/lib/commands/install.js b/lib/commands/install.js
@@ -139,6 +139,12 @@ class Install extends ArboristWorkspaceCmd {
       args = ['.']
     }
 
+    // throw usage error if trying to install empty package
+    // name to global space, e.g: `npm i -g ""`
+    if (where === globalTop && !args.every(Boolean)) {
+      throw this.usageError()
+    }
+
     const opts = {
       ...this.npm.flatOptions,
       auditLevel: null,
diff --git a/test/lib/commands/install.js b/test/lib/commands/install.js
@@ -139,6 +139,23 @@ t.test('should install globally using Arborist', async t => {
   t.strictSame(SCRIPTS, [], 'no scripts when installing globally')
 })
 
+t.test('should not install invalid global package name', async t => {
+  const { npm } = await loadMockNpm(t, {
+    '@npmcli/run-script': () => {},
+    '../../lib/utils/reify-finish.js': async () => {},
+    '@npmcli/arborist': function (args) {
+      throw new Error('should not reify')
+    },
+  })
+  npm.config.set('global', true)
+  npm.globalPrefix = path.resolve(t.testdir({}))
+  await t.rejects(
+    npm.exec('install', ['']),
+    /Usage:/,
+    'should not install invalid package name'
+  )
+})
+
 t.test('npm i -g npm engines check success', async t => {
   const { npm } = await loadMockNpm(t, {
     '../../lib/utils/reify-finish.js': async () => {},
