Implement pagination with link headers for Adoptium based apis

__tests__/distributors/adopt-installer.test.ts

@@ -14,6 +14,7 @@ import * as core from '@actions/core';
 describe('getAvailableVersions', () => {
  let spyHttpClient: jest.SpyInstance;
  let spyCoreError: jest.SpyInstance;
+ let spyCoreWarning: jest.SpyInstance;
 
  beforeEach(() => {
  spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -26,6 +27,8 @@ describe('getAvailableVersions', () => {
  // Mock core.error to suppress error logs
  spyCoreError = jest.spyOn(core, 'error');
  spyCoreError.mockImplementation(() => {});
+ spyCoreWarning = jest.spyOn(core, 'warning');
+ spyCoreWarning.mockImplementation(() => {});
  });
 
  afterEach(() => {
@@ -136,22 +139,19 @@ describe('getAvailableVersions', () => {
  );
 
  it('load available versions', async () => {
+ const nextPageUrl =
+ 'https://api.adoptopenjdk.net/v3/assets/version/%5B1.0,100.0%5D?page=1&page_size=20';
  spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
  spyHttpClient
  .mockReturnValueOnce({
  statusCode: 200,
- headers: {},
+ headers: {link: `<${nextPageUrl}>; rel="next"`},
  result: manifestData as any
  })
  .mockReturnValueOnce({
  statusCode: 200,
  headers: {},
  result: manifestData as any
- })
- .mockReturnValueOnce({
- statusCode: 200,
- headers: {},
- result: []
  });
 
  const distribution = new AdoptDistribution(
@@ -166,6 +166,34 @@ describe('getAvailableVersions', () => {
  const availableVersions = await distribution['getAvailableVersions']();
  expect(availableVersions).not.toBeNull();
  expect(availableVersions.length).toBe(manifestData.length * 2);
+ expect(spyHttpClient).toHaveBeenNthCalledWith(2, nextPageUrl);
+ });
+
+ it('stops pagination after 1000 pages as a safeguard', async () => {
+ const nextPageUrl =
+ 'https://api.adoptopenjdk.net/v3/assets/version/%5B1.0,100.0%5D?page=2&page_size=20';
+ spyHttpClient.mockReturnValue({
+ statusCode: 200,
+ headers: {link: `<${nextPageUrl}>; rel="next"`},
+ result: [{version_data: {semver: '17.0.1'}, binaries: []}] as any
+ });
+
+ const distribution = new AdoptDistribution(
+ {
+ version: '11',
+ architecture: 'x64',
+ packageType: 'jdk',
+ checkLatest: false
+ },
+ AdoptImplementation.Hotspot
+ );
+
+ await distribution['getAvailableVersions']();
+
+ expect(spyHttpClient).toHaveBeenCalledTimes(1000);
+ expect(spyCoreWarning).toHaveBeenCalledWith(
+ expect.stringContaining('Reached pagination safeguard limit (1000 pages)')
+ );
  });
 
  it.each([

__tests__/distributors/semeru-installer.test.ts

@@ -9,6 +9,7 @@ import * as core from '@actions/core';
 describe('getAvailableVersions', () => {
  let spyHttpClient: jest.SpyInstance;
  let spyCoreError: jest.SpyInstance;
+ let spyCoreWarning: jest.SpyInstance;
 
  beforeEach(() => {
  spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -20,6 +21,8 @@ describe('getAvailableVersions', () => {
  // Mock core.error to suppress error logs
  spyCoreError = jest.spyOn(core, 'error');
  spyCoreError.mockImplementation(() => {});
+ spyCoreWarning = jest.spyOn(core, 'warning');
+ spyCoreWarning.mockImplementation(() => {});
  });
 
  afterEach(() => {
@@ -82,22 +85,19 @@ describe('getAvailableVersions', () => {
  );
 
  it('load available versions', async () => {
+ const nextPageUrl =
+ 'https://api.adoptopenjdk.net/v3/assets/version/%5B1.0,100.0%5D?page=1&page_size=20';
  spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
  spyHttpClient
  .mockReturnValueOnce({
  statusCode: 200,
- headers: {},
+ headers: {link: `<${nextPageUrl}>; rel="next"`},
  result: manifestData as any
  })
  .mockReturnValueOnce({
  statusCode: 200,
  headers: {},
  result: manifestData as any
- })
- .mockReturnValueOnce({
- statusCode: 200,
- headers: {},
- result: []
  });
 
  const distribution = new SemeruDistribution({
@@ -109,6 +109,31 @@ describe('getAvailableVersions', () => {
  const availableVersions = await distribution['getAvailableVersions']();
  expect(availableVersions).not.toBeNull();
  expect(availableVersions.length).toBe(manifestData.length * 2);
+ expect(spyHttpClient).toHaveBeenNthCalledWith(2, nextPageUrl);
+ });
+
+ it('stops pagination after 1000 pages as a safeguard', async () => {
+ const nextPageUrl =
+ 'https://api.adoptopenjdk.net/v3/assets/version/%5B1.0,100.0%5D?page=2&page_size=20';
+ spyHttpClient.mockReturnValue({
+ statusCode: 200,
+ headers: {link: `<${nextPageUrl}>; rel="next"`},
+ result: [{version_data: {semver: '17.0.1'}, binaries: []}] as any
+ });
+
+ const distribution = new SemeruDistribution({
+ version: '8',
+ architecture: 'x64',
+ packageType: 'jdk',
+ checkLatest: false
+ });
+
+ await distribution['getAvailableVersions']();
+
+ expect(spyHttpClient).toHaveBeenCalledTimes(1000);
+ expect(spyCoreWarning).toHaveBeenCalledWith(
+ expect.stringContaining('Reached pagination safeguard limit (1000 pages)')
+ );
  });
 
  it.each([

__tests__/distributors/temurin-installer.test.ts

@@ -12,6 +12,7 @@ import * as core from '@actions/core';
 describe('getAvailableVersions', () => {
  let spyHttpClient: jest.SpyInstance;
  let spyCoreError: jest.SpyInstance;
+ let spyCoreWarning: jest.SpyInstance;
 
  beforeEach(() => {
  spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -23,6 +24,8 @@ describe('getAvailableVersions', () => {
  // Mock core.error to suppress error logs
  spyCoreError = jest.spyOn(core, 'error');
  spyCoreError.mockImplementation(() => {});
+ spyCoreWarning = jest.spyOn(core, 'warning');
+ spyCoreWarning.mockImplementation(() => {});
  });
 
  afterEach(() => {
@@ -93,22 +96,19 @@ describe('getAvailableVersions', () => {
  );
 
  it('load available versions', async () => {
+ const nextPageUrl =
+ 'https://api.adoptium.net/v3/assets/version/%5B1.0,100.0%5D?page=1&page_size=20';
  spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
  spyHttpClient
  .mockReturnValueOnce({
  statusCode: 200,
- headers: {},
+ headers: {link: `<${nextPageUrl}>; rel="next"`},
  result: manifestData as any
  })
  .mockReturnValueOnce({
  statusCode: 200,
  headers: {},
  result: manifestData as any
- })
- .mockReturnValueOnce({
- statusCode: 200,
- headers: {},
- result: []
  });
 
  const distribution = new TemurinDistribution(
@@ -123,6 +123,34 @@ describe('getAvailableVersions', () => {
  const availableVersions = await distribution['getAvailableVersions']();
  expect(availableVersions).not.toBeNull();
  expect(availableVersions.length).toBe(manifestData.length * 2);
+ expect(spyHttpClient).toHaveBeenNthCalledWith(2, nextPageUrl);
+ });
+
+ it('stops pagination after 1000 pages as a safeguard', async () => {
+ const nextPageUrl =
+ 'https://api.adoptium.net/v3/assets/version/%5B1.0,100.0%5D?page=2&page_size=20';
+ spyHttpClient.mockReturnValue({
+ statusCode: 200,
+ headers: {link: `<${nextPageUrl}>; rel="next"`},
+ result: [{version_data: {semver: '17.0.1'}, binaries: []}] as any
+ });
+
+ const distribution = new TemurinDistribution(
+ {
+ version: '8',
+ architecture: 'x64',
+ packageType: 'jdk',
+ checkLatest: false
+ },
+ TemurinImplementation.Hotspot
+ );
+
+ await distribution['getAvailableVersions']();
+
+ expect(spyHttpClient).toHaveBeenCalledTimes(1000);
+ expect(spyCoreWarning).toHaveBeenCalledWith(
+ expect.stringContaining('Reached pagination safeguard limit (1000 pages)')
+ );
  });
 
  it.each([

__tests__/util.test.ts

@@ -4,10 +4,12 @@ import * as fs from 'fs';
 import * as path from 'path';
 import {
  convertVersionToSemver,
+ getNextPageUrlFromLinkHeader,
  getVersionFromFileContent,
  isVersionSatisfies,
  isCacheFeatureAvailable,
- isGhes
+ isGhes,
+ validatePaginationUrl
 } from '../src/util';
 
 jest.mock('@actions/cache');
@@ -85,6 +87,78 @@ describe('convertVersionToSemver', () => {
  });
 });
 
+describe('getNextPageUrlFromLinkHeader', () => {
+ it.each([
+ [
+ {
+ link: '<https://api.adoptium.net/v3/info/release_versions?page=1&page_size=10>; rel="next"'
+ },
+ 'https://api.adoptium.net/v3/info/release_versions?page=1&page_size=10'
+ ],
+ [
+ {
+ Link: '<https://example.com/last?page=5>; rel="last", <https://example.com/next?page=2>; rel="next"'
+ },
+ 'https://example.com/next?page=2'
+ ],
+ [
+ {
+ link: '<https://api.adoptium.net/v3/versions?page=3>; type="application/json"; rel="next"'
+ },
+ 'https://api.adoptium.net/v3/versions?page=3'
+ ],
+ [{link: '<https://example.com/last?page=5>; rel="last"'}, null],
+ [{link: '<https://example.com/page?p=2>; rel="nextsomething"'}, null],
+ [undefined, null]
+ ])('returns %s -> %s', (headers, expected) => {
+ expect(getNextPageUrlFromLinkHeader(headers)).toBe(expected);
+ });
+});
+
+describe('validatePaginationUrl', () => {
+ it('accepts URL with matching origin', () => {
+ expect(
+ validatePaginationUrl(
+ 'https://api.adoptium.net/v3/assets?page=2',
+ 'https://api.adoptium.net'
+ )
+ ).toBe(true);
+ });
+
+ it('rejects URL with different host', () => {
+ expect(
+ validatePaginationUrl(
+ 'https://evil.example.com/steal?data=1',
+ 'https://api.adoptium.net'
+ )
+ ).toBe(false);
+ });
+
+ it('rejects URL with different protocol', () => {
+ expect(
+ validatePaginationUrl(
+ 'http://api.adoptium.net/v3/assets?page=2',
+ 'https://api.adoptium.net'
+ )
+ ).toBe(false);
+ });
+
+ it('returns false for invalid URL', () => {
+ expect(validatePaginationUrl('not-a-url', 'https://api.adoptium.net')).toBe(
+ false
+ );
+ });
+
+ it('accepts URL with explicit default port', () => {
+ expect(
+ validatePaginationUrl(
+ 'https://api.adoptium.net:443/v3/assets?page=2',
+ 'https://api.adoptium.net'
+ )
+ ).toBe(true);
+ });
+});
+
 describe('getVersionFromFileContent', () => {
  describe('.sdkmanrc', () => {
  it.each([

dist/cleanup/index.js

@@ -52134,7 +52134,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.renameWinArchive = exports.getGitHubHttpHeaders = exports.convertVersionToSemver = exports.getVersionFromFileContent = exports.isCacheFeatureAvailable = exports.isGhes = exports.isJobStatusSuccess = exports.getToolcachePath = exports.isVersionSatisfies = exports.getDownloadArchiveExtension = exports.extractJdkFile = exports.getVersionFromToolcachePath = exports.getBooleanInput = exports.getTempDir = void 0;
+exports.renameWinArchive = exports.validatePaginationUrl = exports.getNextPageUrlFromLinkHeader = exports.MAX_PAGINATION_PAGES = exports.getGitHubHttpHeaders = exports.convertVersionToSemver = exports.getVersionFromFileContent = exports.isCacheFeatureAvailable = exports.isGhes = exports.isJobStatusSuccess = exports.getToolcachePath = exports.isVersionSatisfies = exports.getDownloadArchiveExtension = exports.extractJdkFile = exports.getVersionFromToolcachePath = exports.getBooleanInput = exports.getTempDir = void 0;
 const os_1 = __importDefault(__nccwpck_require__(22037));
 const path_1 = __importDefault(__nccwpck_require__(71017));
 const fs = __importStar(__nccwpck_require__(57147));
@@ -52301,6 +52301,47 @@ function getGitHubHttpHeaders() {
  return headers;
 }
 exports.getGitHubHttpHeaders = getGitHubHttpHeaders;
+exports.MAX_PAGINATION_PAGES = 1000;
+function getNextPageUrlFromLinkHeader(headers) {
+ var _a;
+ if (!headers) {
+ return null;
+ }
+ const linkHeader = (_a = headers.link) !== null && _a !== void 0 ? _a : headers.Link;
+ if (!linkHeader) {
+ return null;
+ }
+ const normalizedLinkHeader = Array.isArray(linkHeader)
+ ? linkHeader.join(',')
+ : linkHeader;
+ // Split into individual link-values and find the one with rel="next"
+ // RFC 8288 allows rel to appear anywhere among the parameters
+ const linkValues = normalizedLinkHeader.split(/,(?=\s*<)/);
+ for (const linkValue of linkValues) {
+ const urlMatch = linkValue.match(/<([^>]+)>/);
+ if (!urlMatch)
+ continue;
+ const params = linkValue.slice(urlMatch[0].length);
+ // Use word boundary to match "next" as a standalone relation type
+ // RFC 8288 allows space-separated relation types like rel="next prev"
+ if (/;\s*rel="?[^"]*\bnext\b/i.test(params)) {
+ return urlMatch[1];
+ }
+ }
+ return null;
+}
+exports.getNextPageUrlFromLinkHeader = getNextPageUrlFromLinkHeader;
+function validatePaginationUrl(url, allowedOrigin) {
+ try {
+ const parsed = new URL(url);
+ const allowed = new URL(allowedOrigin);
+ return parsed.origin === allowed.origin;
+ }
+ catch (_a) {
+ return false;
+ }
+}
+exports.validatePaginationUrl = validatePaginationUrl;
 // Rename archive to add extension because after downloading
 // archive does not contain extension type and it leads to some issues
 // on Windows runners without PowerShell Core.