fix(token): only follow pagination links on the registry origin

[ManoharPaturi]

Problem

npm token list and npm token revoke page through /-/npm/v1/tokens by following the urls.next link taken verbatim from the registry response:

async function paginate (href, opts, items = []) {
  while (href) {
    const result = await fetch.json(href, opts)
    items = items.concat(result.objects)
    href = result.urls.next
  }
  return items
}

Two consequences:

1. npm-registry-fetch resolves credentials per host, so any link that keeps the registry host but swaps the scheme (an https registry answering with an http:// link) is still sent the Authorization header, now in cleartext. A compromised or hostile registry can use this to expose the bearer token to an on-path attacker.
2. A link pointing at an arbitrary origin is fetched without user configuration, making the client a request generator for a third party.

Reproducing the first case before this change, with the mock registry replying urls.next = 'http://registry.npmjs.org/-/npm/v1/tokens?next=...', the command issues the plaintext request (blocked in tests only by nock's disableNetConnect):

not ok 1 - request to http://registry.npmjs.org/-/npm/v1/tokens?next=... failed,
reason: Nock: Disallowed net connect for "registry.npmjs.org:80/-/npm/v1/tokens?next=..."

Separately, a response that omits the urls object entirely crashes the command with a TypeError.

Solution

Resolve the next link against the configured registry and only follow it when its origin (scheme, host, port) matches the registry origin. Otherwise stop paginating and warn, so a truncated listing is visible rather than silent. Non-string or missing links, including a missing urls object, now end pagination cleanly.

Test Evidence

Four tests added to test/lib/commands/token.js:

• a same-origin absolute link is still followed across pages,
• a scheme downgraded link is not followed, the first page is still listed, and a warning names the ignored link,
• a link to another host is not followed, with the same warning,
• a response without a urls object lists tokens instead of crashing.

The downgrade test fails on the previous code with the disallowed plaintext request shown above. Full file is green with this change: npx tap test/lib/commands/token.js.

References

• Credential resolution by host in npm-registry-fetch: node_modules/npm-registry-fetch/lib/auth.js

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.