[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding

3c480159 correctly made this validator actually enforce, instead of the no-op `awk '{ $0 ~ "..." }'` it had been, but its character class had never been audited against real mirror URLs: it has no `:`, so enabling enforcement silently rejected every mirror URL bearing a port. $ NVM_NODEJS_ORG_MIRROR=https://mirror.internal:8443/dist nvm_ls_remote $NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL No request is made at all, so an internal mirror on a non-default port has been unusable since v0.40.5. Allow RFC 3986 `unreserved` plus the authority and path punctuation a mirror URL legitimately needs: `:` for a port, `@` for userinfo, `[`/`]` for an IPv6 literal host, and `%` for percent-encoding. `sub-delims` and the query/fragment delimiters stay rejected: nvm appends a path to this value, so a query string could never have worked, and several of those characters are shell metacharacters.
2026-09-08 00:00:07 +08:00 · 2026-09-02 19:40:47 -07:00
parent dd0f702fb1
commit 10a277ec47
2 changed files with 31 additions and 1 deletions
@@ -52,3 +52,26 @@ testMirrors 'not a url'
 testMirrors 'ftp://wrong-scheme'
 testMirrors 'http://'
 testMirrors 'javascript:alert(1)'
+
+# a query string can never work, since nvm appends a path to the mirror
+testMirrors 'https://nodejs.org/dist?token=abc'
+testMirrors 'https://nodejs.org/dist#frag'
+
+testAcceptedMirrors() {
+  NVM_NODEJS_ORG_MIRROR="${1-}"
+  [ "$(nvm_get_mirror node std)" = "${1-}" ] || die "NVM_NODEJS_ORG_MIRROR should accept ${1-}"
+  unset NVM_NODEJS_ORG_MIRROR
+
+  NVM_IOJS_ORG_MIRROR="${1-}"
+  [ "$(nvm_get_mirror iojs std)" = "${1-}" ] || die "NVM_IOJS_ORG_MIRROR should accept ${1-}"
+  unset NVM_IOJS_ORG_MIRROR
+}
+
+# a private mirror on a non-default port is a URL, and must not be rejected
+testAcceptedMirrors 'https://mirror.internal:8443/dist'
+testAcceptedMirrors 'http://localhost:8080/dist'
+# an IPv6 literal host, userinfo, percent-encoding, and `~` are all legal too
+testAcceptedMirrors 'http://[::1]:8080/dist'
+testAcceptedMirrors 'https://user:pw@nexus.corp.example.com/repository/nodejs-dist'
+testAcceptedMirrors 'https://mirror.internal/a%20b/dist'
+testAcceptedMirrors 'https://mirror.internal/~dist'