[Robustness] install.sh, nvm uninstall: pass the version to grep with -e
`install_nvm_from_git` passed `$NVM_INSTALL_VERSION` to grep as a bare argument, and `nvm uninstall` did the same with the resolved version when looking for aliases that point to it, so a value starting with `-` would have been parsed as grep options rather than as the pattern. Neither value crosses a trust boundary (the first is the user's own environment variable, and the second is an already-installed version, which never starts with `-`), but every grep that receives a version should put it after `-e`, which POSIX specifies and which nvm.sh already uses elsewhere Discovered by Anthropic's OSS Scanner, alongside vulnerability ANT-2026-EN9DM7WC; this change is not itself a vulnerability fix.
This commit is contained in:
2 files changed
+2
-2
No files matched your search
+1
-1
@@ -157,7 +157,7 @@ install_nvm_from_git() {
|
||||
NVM_VERSION="${NVM_INSTALL_VERSION:-$(nvm_latest_version)}"
|
||||
if [ -n "${NVM_INSTALL_VERSION:-}" ]; then
|
||||
# Check if version is an existing ref
|
||||
if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q "$NVM_VERSION" ; then
|
||||
if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q -e "$NVM_VERSION" ; then
|
||||
:
|
||||
# Check if version is an existing changeset
|
||||
elif ! nvm_download -o /dev/null "$(nvm_source "script-nvm-exec")"; then
|
||||
|
||||
Reference in new issue
Block a user