fix: Reject dependency names with leading/trailing whitespace (fixes duplicate installs)

.yarn/versions/d1ff2adc.yml

@@ -0,0 +1,24 @@
+releases:
+  "@yarnpkg/cli": patch
+  "@yarnpkg/plugin-npm": patch
+  "@yarnpkg/plugin-npm-cli": patch
+
+declined:
+  - "@yarnpkg/plugin-compat"
+  - "@yarnpkg/plugin-constraints"
+  - "@yarnpkg/plugin-dlx"
+  - "@yarnpkg/plugin-essentials"
+  - "@yarnpkg/plugin-init"
+  - "@yarnpkg/plugin-interactive-tools"
+  - "@yarnpkg/plugin-nm"
+  - "@yarnpkg/plugin-pack"
+  - "@yarnpkg/plugin-patch"
+  - "@yarnpkg/plugin-pnp"
+  - "@yarnpkg/plugin-pnpm"
+  - "@yarnpkg/plugin-stage"
+  - "@yarnpkg/plugin-typescript"
+  - "@yarnpkg/plugin-version"
+  - "@yarnpkg/plugin-workspace-tools"
+  - "@yarnpkg/builder"
+  - "@yarnpkg/core"
+  - "@yarnpkg/doctor"

packages/acceptance-tests/pkg-tests-specs/sources/commands/install.test.ts

@@ -994,5 +994,18 @@ module.exports = {
         });
       }),
     );
+
+    test(
+      `it should throw when package name cannot be resolved`,
+      makeTemporaryEnv({
+        dependencies: {
+          [`no-deps `]: `1.0.0`,
+        },
+      }, async ({path, run, source}) => {
+        await expect(run(`install`)).rejects.toMatchObject({
+          stdout: expect.stringMatching(/Package not found/),
+        });
+      }),
+    );
   });
 });

packages/plugin-npm/sources/NpmSemverFetcher.ts

@@ -94,6 +94,9 @@ export class NpmSemverFetcher implements Fetcher {
     if (version === null)
       throw new ReportError(MessageName.RESOLVER_NOT_FOUND, `The npm semver resolver got selected, but the version isn't semver`);
 
-    return `${npmHttpUtils.getIdentUrl(locator)}/-/${locator.name}-${version}.tgz`;
+    const encodedName = encodeURIComponent(locator.name);
+    const encodedVersion = encodeURIComponent(version);
+
+    return `${npmHttpUtils.getIdentUrl(locator)}/-/${encodedName}-${encodedVersion}.tgz`;
   }
 }

packages/plugin-npm/sources/npmHttpUtils.ts

@@ -61,9 +61,9 @@ export function customPackageError(error: httpUtils.RequestError, configuration:
 
 export function getIdentUrl(ident: Ident) {
   if (ident.scope) {
-    return `/@${ident.scope}%2f${ident.name}`;
+    return `/@${encodeURIComponent(ident.scope)}%2f${encodeURIComponent(ident.name)}`;
   } else {
-    return `/${ident.name}`;
+    return `/${encodeURIComponent(ident.name)}`;
   }
 }