eeymoo/nvm
1
0
Fork 0
mirror of https://github.com/nvm-sh/nvm.git synced 2026-07-18 04:48:22 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[Fix] use command to bypass curl/wget shell functions and aliases

Browse Source 
zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time,
and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads.
Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`;
the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit.

The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead,
via a shared `make_fake_curl` helper in `test/common.sh`,
and a new test asserts the bypass.

Refs #2923
This commit is contained in:
Jordan Harband
2026-07-08 13:02:41 -07:00
parent cb0e0ba8ed
commit 04fef13bdc
9 changed files with 172 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.sh
+1 -1
View File
@@ -119,7 +119,7 @@ nvm_download() {
-e 's/-o /-O /' \
-e 's/-C - /-c /')
# shellcheck disable=SC2086
eval wget $ARGS
eval command wget $ARGS
fi
}
nvm.sh
+4 -4
View File
@@ -87,7 +87,7 @@ nvm_has_colors() {
}
nvm_curl_libz_support() {
curl -V 2>/dev/null | nvm_grep "^Features:" | nvm_grep -q "libz"
command curl -V 2>/dev/null | nvm_grep "^Features:" | nvm_grep -q "libz"
}
nvm_curl_use_compression() {
@@ -103,7 +103,7 @@ nvm_get_latest() {
fi
NVM_LATEST_URL="$(curl ${CURL_COMPRESSED_FLAG:-} -q -w "%{url_effective}\\n" -L -s -S https://latest.nvm.sh -o /dev/null)"
elif nvm_has "wget"; then
NVM_LATEST_URL="$(wget -q https://latest.nvm.sh --server-response -O /dev/null 2>&1 | command awk '/^ Location: /{DEST=$2} END{ print DEST }')"
NVM_LATEST_URL="$(command wget -q https://latest.nvm.sh --server-response -O /dev/null 2>&1 | command awk '/^ Location: /{DEST=$2} END{ print DEST }')"
else
nvm_err 'nvm needs curl or wget to proceed.'
return 1
@@ -170,7 +170,7 @@ nvm_download() {
set -- "$@" --header "Authorization: ${sanitized_header}"
fi
"${NVM_DOWNLOADER}" "$@"
command "${NVM_DOWNLOADER}" "$@"
}
nvm_sanitize_auth_header() {
@@ -649,7 +649,7 @@ nvm_clang_version() {
}
nvm_curl_version() {
curl -V | command awk '{ if ($1 == "curl") print $2 }' | command sed 's/-.*$//g'
command curl -V | command awk '{ if ($1 == "curl") print $2 }' | command sed 's/-.*$//g'
}
nvm_version_greater() {
test/common.sh
+33
View File
@@ -50,6 +50,39 @@ make_echo() {
chmod a+x "$1"
}
# `command curl` bypasses shell functions and aliases, so tests that mock curl
# must provide an actual executable on the PATH: this creates one in the given
# directory. Invoked as `curl -V`, it prints ${VERSION_MESSAGE} (exported here
# on the mock's behalf); any other invocation runs the body given as the
# second argument, or fails.
make_fake_curl() {
local FAKE_BIN_DIR
FAKE_BIN_DIR="${1-}"
[ -n "${FAKE_BIN_DIR}" ] || return 1
local FAKE_CURL_BODY
FAKE_CURL_BODY="${2-}"
if [ -z "${FAKE_CURL_BODY}" ]; then
FAKE_CURL_BODY='echo >&2 "This fake curl only takes one parameter, -V"
exit 1'
fi
mkdir -p "${FAKE_BIN_DIR}" || return 2
{
echo '#!/bin/sh'
echo 'if [ "$#" -eq 1 ] && [ "$1" = "-V" ]; then'
echo ' echo "${VERSION_MESSAGE}"'
echo ' exit 0'
echo 'fi'
printf '%s\n' "${FAKE_CURL_BODY}"
} > "${FAKE_BIN_DIR}/curl"
chmod +x "${FAKE_BIN_DIR}/curl"
# the fake curl reads VERSION_MESSAGE from the environment
export VERSION_MESSAGE
}
make_fake_node() {
local VERSION
VERSION="${1-}"
test/fast/Unit tests/nvm_curl_libz_support
+18 -18
View File
@@ -1,7 +1,11 @@
#!/bin/sh
WORK="$PWD/nvm_curl_libz_support-work.$$"
TEST_BIN="$WORK/bin"
cleanup() {
unset -f curl
rm -rf "$WORK"
export PATH="$OLDPATH"
}
die() { cleanup; echo "$@" ; exit 1; }
@@ -9,32 +13,28 @@ die() { cleanup; echo "$@" ; exit 1; }
: nvm.sh
\. ../../../nvm.sh
curl() {
# curl with libz feature
if [ $# -ne 1 ] || [ "$1" != "-V" ]; then
die "This fake curl only takes one parameter -V"
fi
echo "
\. ../../common.sh
OLDPATH="$PATH"
make_fake_curl "$TEST_BIN"
export PATH="$TEST_BIN:$OLDPATH"
# curl with libz feature
VERSION_MESSAGE="
curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP UnixSockets"
}
nvm_curl_libz_support || die "nvm_curl_libz_support should return 0"
unset -f curl
curl() {
# curl without libz feature
if [ "$#" -ne 1 ] || [ "$1" != "-V" ]; then
die "This fake curl only takes one parameter -V"
fi
echo "
# curl without libz feature
VERSION_MESSAGE="
curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.32
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL TLS-SRP UnixSockets"
}
! nvm_curl_libz_support || die "nvm_curl_libz_support should return 1"
unset -f curl
cleanup
test/fast/Unit tests/nvm_curl_use_compression
+12 -5
View File
@@ -1,18 +1,25 @@
#!/bin/sh
WORK="$PWD/nvm_curl_use_compression-work.$$"
TEST_BIN="$WORK/bin"
cleanup () {
unset -f die
rm -rf "$WORK"
export PATH="$OLDPATH"
}
die () { echo -e "$@" ; cleanup ; exit 1; }
NVM_ENV=testing \. ../../../nvm.sh
curl() {
if [ "$1" = "-V" ]; then
echo "${VERSION_MESSAGE}"
fi
}
\. ../../common.sh
OLDPATH="$PATH"
make_fake_curl "$TEST_BIN"
export PATH="$TEST_BIN:$OLDPATH"
CURL_VERSION_ON_ARCHLINUX_WITH_LIBZ="curl 7.54.0 (x86_64-pc-linux-gnu) libcurl/7.54.0 OpenSSL/1.1.0f zlib/1.2.11 libpsl/0.17.0 (+libicu/59.1) libssh2/1.8.0 nghttp2/1.22.0
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
test/fast/Unit tests/nvm_curl_version
+13 -7
View File
@@ -1,19 +1,25 @@
#!/bin/sh
WORK="$PWD/nvm_curl_version-work.$$"
TEST_BIN="$WORK/bin"
cleanup () {
unset -f die
unset -f curl
unset -f die cleanup assert_version_is
rm -rf "$WORK"
export PATH="$OLDPATH"
}
die () { echo -e "$@" ; cleanup ; exit 1; }
NVM_ENV=testing \. ../../../nvm.sh
curl() {
if [ "$1" = "-V" ]; then
echo "${VERSION_MESSAGE}"
fi
}
\. ../../common.sh
OLDPATH="$PATH"
make_fake_curl "$TEST_BIN"
export PATH="$TEST_BIN:$OLDPATH"
assert_version_is() {
if [ "${1}" != "${2}" ]; then
test/fast/Unit tests/nvm_download and curl helpers bypass shadowed curl
Executable
+48
View File
@@ -0,0 +1,48 @@
#!/bin/sh
WORK="$PWD/shadowed-curl-work.$$"
TEST_BIN="$WORK/bin"
ARGV_LOG="$WORK/argv.log"
cleanup () {
unset -f die cleanup curl wget
rm -rf "$WORK"
export PATH="$OLDPATH"
}
die () { echo "$@" ; cleanup ; exit 1; }
NVM_ENV=testing \. ../../../nvm.sh
\. ../../common.sh
OLDPATH="$PATH"
# real-looking curl on PATH; calling the shadowing shell function below instead is a failure
make_fake_curl "$TEST_BIN" ': > "$ARGV_LOG"
for a in "$@"; do printf "%s\n" "$a" >> "$ARGV_LOG"; done'
VERSION_MESSAGE="curl 7.99.0 (fake)
Features: libz"
export ARGV_LOG
export PATH="$TEST_BIN:$OLDPATH"
# shadowing shell functions, like aliases baked into a user's shell, must be
# bypassed in favor of the executables on PATH (https://github.com/nvm-sh/nvm/issues/2923)
curl() {
echo 'curl 0.0.0-shadowed'
return 1
}
wget() {
return 1
}
[ "$(nvm_curl_version)" = '7.99.0' ] || die "nvm_curl_version used the shadowing curl function; got $(nvm_curl_version)"
nvm_curl_libz_support || die 'nvm_curl_libz_support used the shadowing curl function'
nvm_download -s 'http://example.com/' -o /dev/null || die 'nvm_download used the shadowing curl function and failed'
grep -Fxq 'http://example.com/' "$ARGV_LOG" || die "nvm_download did not invoke the curl executable; got: $(cat "$ARGV_LOG")"
cleanup
test/slow/nvm_get_latest/nvm_get_latest
+30 -26
View File
@@ -2,37 +2,45 @@
die () { echo "$@" ; cleanup ; exit 1; }
WORK="$PWD/nvm_get_latest-work.$$"
TEST_BIN="$WORK/bin"
cleanup() {
unset -f curl wget nvm_has
rm -rf "$WORK"
export PATH="$OLDPATH"
}
\. ../../../nvm.sh
\. ../../common.sh
OLDPATH="$PATH"
EXPECTED_VERSION="v12.3.456"
URL="https://github.com/nvm-sh/nvm/releases/tag/$EXPECTED_VERSION"
EXPECTED_CURL_ARGS="--compressed -q -w %{url_effective}\n -L -s -S https://latest.nvm.sh -o /dev/null"
EXPECTED_WGET_ARGS="-q https://latest.nvm.sh --server-response -O /dev/null"
export URL EXPECTED_CURL_ARGS EXPECTED_WGET_ARGS
curl() {
if [ $# -eq 1 ] && [ "$1" = "-V" ]; then
echo "
VERSION_MESSAGE="
curl 7.47.0 (x86_64-pc-linux-gnu) libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP UnixSockets"
elif [ "_$*" != "_$EXPECTED_CURL_ARGS" ]; then
echo >&2 "expected args ($EXPECTED_CURL_ARGS), got ($*)"
return 1
else
echo $URL
fi
}
wget() {
if [ "_$*" != "_$EXPECTED_WGET_ARGS" ]; then
echo >&2 "expected args ($EXPECTED_WGET_ARGS), got ($*)"
return 1
else
local WGET_CONTENTS
WGET_CONTENTS="
# fake curl/wget: `command curl` bypasses shell functions, so the mocks must be executables on PATH
make_fake_curl "$TEST_BIN" 'if [ "_$*" != "_$EXPECTED_CURL_ARGS" ]; then
echo >&2 "expected args ($EXPECTED_CURL_ARGS), got ($*)"
exit 1
fi
echo "$URL"'
cat > "$TEST_BIN/wget" <<'OUTER'
#!/bin/sh
if [ "_$*" != "_$EXPECTED_WGET_ARGS" ]; then
echo >&2 "expected args ($EXPECTED_WGET_ARGS), got ($*)"
exit 1
fi
cat >&2 <<CONTENTS
HTTP/1.1 301 Moved Permanently
Location: https://github.com/nvm-sh/nvm/releases/latest
Content-Type: text/html; charset=utf-8
@@ -82,15 +90,11 @@ wget() {
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
X-Served-By: 926b734ea1992f8ee1f88ab967a93dac
"
"$WGET_CONTENTS" | while read line
do
>&2 echo "$line"
done
fi
}
CONTENTS
OUTER
chmod +x "$TEST_BIN/wget"
\. ../../common.sh
export PATH="$TEST_BIN:$OLDPATH"
try nvm_get_latest
[ "_$CAPTURED_STDOUT" = "_$EXPECTED_VERSION" ] \
test/slow/nvm_get_latest/nvm_get_latest failed redirect
+13 -7
View File
@@ -2,20 +2,26 @@
die () { echo "$@" ; cleanup ; exit 1; }
WORK="$PWD/nvm_get_latest_failed_redirect-work.$$"
TEST_BIN="$WORK/bin"
cleanup() {
unset -f curl wget
rm -rf "$WORK"
export PATH="$OLDPATH"
}
\. ../../../nvm.sh
\. ../../common.sh
curl() {
return 1
}
wget() {
return 1
}
OLDPATH="$PATH"
# fake curl/wget: `command curl` bypasses shell functions, so the mocks must be executables on PATH
make_fake_curl "$TEST_BIN" 'exit 1'
printf '#!/bin/sh\nexit 1\n' > "$TEST_BIN/wget"
chmod +x "$TEST_BIN/wget"
export PATH="$TEST_BIN:$OLDPATH"
try_err nvm_get_latest
[ "_$CAPTURED_STDERR" = "_https://latest.nvm.sh did not redirect to the latest release on GitHub" ] \