From d04111d48ca59fce27909712b328fe5cfc4d016d Mon Sep 17 00:00:00 2001
From: Gar <gar+gh@danger.computer>
Date: Fri, 2 Feb 2024 19:47:45 -0800
Subject: [PATCH] fix(view): filter out invalid semver (#7197)

---
 lib/commands/view.js                             | 8 +++++++-
 tap-snapshots/test/lib/commands/view.js.test.cjs | 4 ++++
 test/lib/commands/view.js                        | 8 ++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/lib/commands/view.js b/lib/commands/view.js
index 214a45e92611c..b19604f8c2ed3 100644
--- a/lib/commands/view.js
+++ b/lib/commands/view.js
@@ -211,7 +211,13 @@ class View extends BaseCommand {
 
     const data = []
     const versions = pckmnt.versions || {}
-    pckmnt.versions = Object.keys(versions).sort(semver.compareLoose)
+    pckmnt.versions = Object.keys(versions).filter(v => {
+      if (semver.valid(v)) {
+        return true
+      }
+      log.info('view', `Ignoring invalid version: ${v}`)
+      return false
+    }).sort(semver.compareLoose)
 
     // remove readme unless we asked for it
     if (args.indexOf('readme') === -1) {
diff --git a/tap-snapshots/test/lib/commands/view.js.test.cjs b/tap-snapshots/test/lib/commands/view.js.test.cjs
index 1c37e26db7f82..3bda4e7de2853 100644
--- a/tap-snapshots/test/lib/commands/view.js.test.cjs
+++ b/tap-snapshots/test/lib/commands/view.js.test.cjs
@@ -190,6 +190,10 @@ dist-tags:
 latest: 1.0.0
 `
 
+exports[`test/lib/commands/view.js TAP package with invalid version > must match snapshot 1`] = `
+[ '1.0.0', '1.0.1' ]
+`
+
 exports[`test/lib/commands/view.js TAP package with maintainers info as object > must match snapshot 1`] = `
 
 pink@1.0.0 | Proprietary | deps: none | versions: 2
diff --git a/test/lib/commands/view.js b/test/lib/commands/view.js
index a99c8d6242212..92c7fe47bda06 100644
--- a/test/lib/commands/view.js
+++ b/test/lib/commands/view.js
@@ -250,6 +250,8 @@ const packument = (nv, opts) => {
           },
         },
         '1.0.1': {},
+        '100000000000000000.0.0': {
+        },
       },
     },
   }
@@ -315,6 +317,12 @@ t.test('package with homepage', async t => {
   t.matchSnapshot(outputs.join('\n'))
 })
 
+t.test('package with invalid version', async t => {
+  const { view, outputs } = await loadMockNpm(t, { config: { unicode: false } })
+  await view.exec(['orange', 'versions'])
+  t.matchSnapshot(outputs.join('\n'))
+})
+
 t.test('package with no versions', async t => {
   const { view, outputs } = await loadMockNpm(t, { config: { unicode: false } })
   await view.exec(['brown'])