[Fix] use command to bypass curl/wget shell functions and aliases

zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time,
and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads.
Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`;
the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit.

The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead,
via a shared `make_fake_curl` helper in `test/common.sh`,
and a new test asserts the bypass.

Refs #2923

test/fast/Unit tests/nvm_curl_libz_support

@@ -1,7 +1,11 @@
 #!/bin/sh
 
+WORK="$PWD/nvm_curl_libz_support-work.$$"
+TEST_BIN="$WORK/bin"
+
 cleanup() {
-  unset -f curl
+  rm -rf "$WORK"
+  export PATH="$OLDPATH"
 }
 
 die() { cleanup; echo "$@" ; exit 1; }
@@ -9,32 +13,28 @@ die() { cleanup; echo "$@" ; exit 1; }
 : nvm.sh
 \. ../../../nvm.sh
 
-curl() {
-    # curl with libz feature
-    if [ $# -ne 1 ] || [ "$1" != "-V" ]; then
-        die "This fake curl only takes one parameter -V"
-    fi
-    echo "
+\. ../../common.sh
+
+OLDPATH="$PATH"
+
+make_fake_curl "$TEST_BIN"
+
+export PATH="$TEST_BIN:$OLDPATH"
+
+# curl with libz feature
+VERSION_MESSAGE="
 curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
 Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP UnixSockets"
-}
 
 nvm_curl_libz_support || die "nvm_curl_libz_support should return 0"
 
-unset -f curl
-
-curl() {
-    # curl without libz feature
-    if [ "$#" -ne 1 ] || [ "$1" != "-V" ]; then
-        die "This fake curl only takes one parameter -V"
-    fi
-    echo "
+# curl without libz feature
+VERSION_MESSAGE="
 curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.32
 Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
 Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL TLS-SRP UnixSockets"
-}
 
 ! nvm_curl_libz_support || die "nvm_curl_libz_support should return 1"
 
-unset -f curl
+cleanup

test/fast/Unit tests/nvm_curl_use_compression

@@ -1,18 +1,25 @@
 #!/bin/sh
 
+WORK="$PWD/nvm_curl_use_compression-work.$$"
+TEST_BIN="$WORK/bin"
+
 cleanup () {
   unset -f die
+  rm -rf "$WORK"
+  export PATH="$OLDPATH"
 }
 
 die () { echo -e "$@" ; cleanup ;  exit 1; }
 
 NVM_ENV=testing \. ../../../nvm.sh
 
-curl() {
-  if [ "$1" = "-V" ]; then
-    echo "${VERSION_MESSAGE}"
-  fi
-}
+\. ../../common.sh
+
+OLDPATH="$PATH"
+
+make_fake_curl "$TEST_BIN"
+
+export PATH="$TEST_BIN:$OLDPATH"
 
 CURL_VERSION_ON_ARCHLINUX_WITH_LIBZ="curl 7.54.0 (x86_64-pc-linux-gnu) libcurl/7.54.0 OpenSSL/1.1.0f zlib/1.2.11 libpsl/0.17.0 (+libicu/59.1) libssh2/1.8.0 nghttp2/1.22.0
 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp

test/fast/Unit tests/nvm_curl_version

@@ -1,19 +1,25 @@
 #!/bin/sh
 
+WORK="$PWD/nvm_curl_version-work.$$"
+TEST_BIN="$WORK/bin"
+
 cleanup () {
-  unset -f die
-  unset -f curl
+  unset -f die cleanup assert_version_is
+  rm -rf "$WORK"
+  export PATH="$OLDPATH"
 }
 
 die () { echo -e "$@" ; cleanup ;  exit 1; }
 
 NVM_ENV=testing \. ../../../nvm.sh
 
-curl() {
-  if [ "$1" = "-V" ]; then
-    echo "${VERSION_MESSAGE}"
-  fi
-}
+\. ../../common.sh
+
+OLDPATH="$PATH"
+
+make_fake_curl "$TEST_BIN"
+
+export PATH="$TEST_BIN:$OLDPATH"
 
 assert_version_is() {
   if [ "${1}" != "${2}" ]; then

test/fast/Unit tests/nvm_download and curl helpers bypass shadowed curl

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+WORK="$PWD/shadowed-curl-work.$$"
+TEST_BIN="$WORK/bin"
+ARGV_LOG="$WORK/argv.log"
+
+cleanup () {
+  unset -f die cleanup curl wget
+  rm -rf "$WORK"
+  export PATH="$OLDPATH"
+}
+
+die () { echo "$@" ; cleanup ; exit 1; }
+
+NVM_ENV=testing \. ../../../nvm.sh
+
+\. ../../common.sh
+
+OLDPATH="$PATH"
+
+# real-looking curl on PATH; calling the shadowing shell function below instead is a failure
+make_fake_curl "$TEST_BIN" ': > "$ARGV_LOG"
+for a in "$@"; do printf "%s\n" "$a" >> "$ARGV_LOG"; done'
+
+VERSION_MESSAGE="curl 7.99.0 (fake)
+Features: libz"
+
+export ARGV_LOG
+export PATH="$TEST_BIN:$OLDPATH"
+
+# shadowing shell functions, like aliases baked into a user's shell, must be
+# bypassed in favor of the executables on PATH (https://github.com/nvm-sh/nvm/issues/2923)
+curl() {
+  echo 'curl 0.0.0-shadowed'
+  return 1
+}
+wget() {
+  return 1
+}
+
+[ "$(nvm_curl_version)" = '7.99.0' ] || die "nvm_curl_version used the shadowing curl function; got $(nvm_curl_version)"
+
+nvm_curl_libz_support || die 'nvm_curl_libz_support used the shadowing curl function'
+
+nvm_download -s 'http://example.com/' -o /dev/null || die 'nvm_download used the shadowing curl function and failed'
+grep -Fxq 'http://example.com/' "$ARGV_LOG" || die "nvm_download did not invoke the curl executable; got: $(cat "$ARGV_LOG")"
+
+cleanup