[Fix] nvm_is_natural_num: reject anything but digits

`[ "$1" -eq "$1" ]` accepts more than a natural number:
a leading `+`, and leading or trailing whitespace,
and in ksh it evaluates its operands as arithmetic expressions,
so words like `install` and expressions like `1+1` or `V=1` pass too.
Values with any non-digit character are now rejected before that test.

The sunos and aix branches of `nvm_get_make_jobs` count cores with `wc -l`,
which on those platforms pads the count with whitespace,
so that count is now stripped of whitespace before it is checked

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-SYLQD6PZ; the scanner correctly classified it as not a vulnerability.
This commit is contained in:
Jordan Harband committed 2026-10-22 20:10:42 -07:00
1 parent 8df635740e
commit 813b5f6dcc
3 files changed
+22 -2

No files matched your search

+12
View File
@@ -132,6 +132,18 @@ run darwin
assert_jobs 3 'darwin uses sysctl'
assert_not_nagged 'darwin uses sysctl'
# BSD-derived `wc`s right-align the count
shim wc "echo ' 4'"
shim psrinfo 'echo 0; echo 1; echo 2; echo 3'
run sunos
assert_jobs 3 'sunos with a padded wc'
assert_not_nagged 'sunos with a padded wc'
shim pmcycles 'echo 0; echo 1; echo 2; echo 3'
run aix
assert_jobs 3 'aix with a padded wc'
assert_not_nagged 'aix with a padded wc'
export PATH="${ORIG_PATH}"
# an explicit count short-circuits detection entirely
+6
View File
@@ -12,6 +12,12 @@ die () { echo "$@" ; exit 1; }
! nvm_is_natural_num --1 || 'double negative number is not false'
! nvm_is_natural_num 1.2 || 'decimal number is not false'
! nvm_is_natural_num 0 || die 'zero is not false'
! nvm_is_natural_num +3 || die 'explicitly positive number is not false'
! nvm_is_natural_num ' 3' || die 'leading whitespace is not false'
! nvm_is_natural_num '3 ' || die 'trailing whitespace is not false'
! nvm_is_natural_num install || die 'a word is not false'
! nvm_is_natural_num V=1 || die 'an assignment is not false'
! nvm_is_natural_num 1+1 || die 'an expression is not false'
nvm_is_natural_num 1 || die '1 is not true'
nvm_is_natural_num 2 || die '2 is not true'