Repository: lirantal/lockfile-lint (js)

Issue:
allowed-hosts failing on urls with port and no scheme
<!--- Provide a general summary of the issue in the Title above -->
Hi there! We've been using lockfile-lint at our company. We have been specifying `--allowed-hosts` with a domain and port, like this: `nexus.example.com:8089`. Up until yesterday, this worked fine:

```
npx lockfile-lint --path package-lock.json --allowed-hosts nexus.example.com:8089 registry.npmjs.org
```

As of today, the above command results in false positives that look like this:
```
detected invalid host(s) for package: zero-crossings@1.0.1-72cbc63a942ee565369f9524fb69fdbe2d885364
    expected: ,registry.npmjs.org
    actual: nexus.example.com:8089
```
(Note the leading comma in the "expected" value. It seems that this CLI argument is being parsed incorrectly?)

Changing `nexus.example.com:8089` to `https://nexus.example.com:8089` makes it work again.

## Expected Behavior

Expected allowed-hosts not to require a scheme. 

<!--- If you're describing a bug, tell us what should happen -->
<!--- If you're suggesting a change/improvement, tell us how it should work -->

## Current Behavior

When using a port in an allowed-host, it doesn't work unless you use a scheme as well. And if that's a feature not a bug, then the error message could be improved.

<!--- If describing a bug, tell us what happens instead of the expected behavior -->
<!--- If suggesting a change/improvement, explain the difference from current behavior -->


## Your Environment

<!--- Include as many relevant details about the environment you experienced the bug in -->

- Library Version used: 4.3.3
- Node.js version (e.g. Node.js 5.4): 12.9.1, npm 6.12.1
- Operating System and version (desktop or mobile): linux

Pull request:
fix: support host:port syntax
## Description

This PR fixes the problem where a host is provided with a port, such as `mydomain.com:1234` and treats it as-is if it can't parse it. 

## Types of changes

<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)

## Related Issue

Fixes #93 

<!--- This project only accepts pull requests related to open issues -->
<!--- If suggesting a new feature or change, please discuss it in an issue first -->
<!--- If fixing a bug, there should be an issue describing it with steps to reproduce -->
<!--- Please link to the issue here: -->


Patch:
diff --git a/packages/lockfile-lint-api/src/validators/ValidateHost.js b/packages/lockfile-lint-api/src/validators/ValidateHost.js
index 52007ea..516fa71 100644
--- a/packages/lockfile-lint-api/src/validators/ValidateHost.js
+++ b/packages/lockfile-lint-api/src/validators/ValidateHost.js
@@ -33,16 +33,20 @@ module.exports = class ValidateHost {
         const allowedHosts = hosts.map(allowedHost => {
           // eslint-disable-next-line security/detect-object-injection
           const host = REGISTRY[allowedHost] ? REGISTRY[allowedHost] : allowedHost
-          let hostValue
+          let hostValue = host
+
           try {
             const parsedHost = new URL(host)
-            hostValue = parsedHost.host
+            if (parsedHost.host) {
+              hostValue = parsedHost.host
+            }
           } catch (error) {
-            hostValue = host
+            debug(`failed parsing a URL object from given host value so using as is: ${host}`)
           }
 
           return hostValue
         })
+
         const isPassing = allowedHosts.includes(packageResolvedURL.host)
         if (!isPassing) {
           if (!packageResolvedURL.host && options && options.emptyHostname) {


Test patch:
diff --git a/packages/lockfile-lint-api/__tests__/validators.host.test.js b/packages/lockfile-lint-api/__tests__/validators.host.test.js
index b788fe1..bd262a0 100644
--- a/packages/lockfile-lint-api/__tests__/validators.host.test.js
+++ b/packages/lockfile-lint-api/__tests__/validators.host.test.js
@@ -241,4 +241,38 @@ describe('Validator: Host', () => {
 
     expect(validator.validateSingle('meow', ['npm'])).toEqual(true)
   })
+
+  it('validator should succeed if resources match a host:port address as input', () => {
+    const mockedPackages = {
+      '@babel/code-frame': {
+        resolved: 'https://nexus.example.com:8089/@babel/code-frame/-/code-frame-7.0.0.tgz'
+      },
+      meow: {
+        resolved: 'https://registry.yarnpkg.com/meow/-/meow-4.0.1.tgz'
+      },
+      '@babel/generator': {
+        resolved: 'https://nexus.example.com:8089/@babel/generator/-/generator-7.4.4.tgz'
+      }
+    }
+
+    const validator = new ValidatorHost({packages: mockedPackages})
+    expect(validator.validate(['yarn', 'nexus.example.com:8089'])).toEqual({
+      type: 'success',
+      errors: []
+    })
+  })
+
+  it('validator should succeed if a resource matches a host:port address as input', () => {
+    const mockedPackages = {
+      '@babel/code-frame': {
+        resolved: 'https://nexus.example.com:8089/@babel/code-frame/-/code-frame-7.0.0.tgz'
+      }
+    }
+
+    const validator = new ValidatorHost({packages: mockedPackages})
+    expect(validator.validate(['nexus.example.com:8089'])).toEqual({
+      type: 'success',
+      errors: []
+    })
+  })
 })