[Tests] nvm install v1 works: get the version from nvm_remote_version, not the ls-remote display

The test took the last `nvm ls-remote` line and trimmed its whitespace, which kept the markers `ls-remote` adds once that version is installed (a trailing ` *`) or current (a leading `->`), so it passed eg `iojs-v1.8.4 *` to `nvm run` as the version.
That only resolved because `nvm_ls` interpreted ` *` as a regex; ask `nvm_remote_version` for the version instead.

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-HZAFTTUK; the scanner correctly classified it as not a vulnerability.
This commit is contained in:
Jordan Harband committed 2026-10-22 20:10:42 -07:00
1 parent 6b9650c47f
commit b076039a60
1 file changed
+1 -1
+1 -1
View File
@@ -5,7 +5,7 @@ die () { echo "$@" ; exit 1; }
\. ../../nvm.sh
NVM_VERSION="v1"
NVM_PREFIXED_TEST_VERSION="$(nvm ls-remote "$NVM_VERSION" | tail -1 | sed 's/^[ ]*//;s/[ ]*$//')"
NVM_PREFIXED_TEST_VERSION="$(nvm_remote_version "$NVM_VERSION")"
NVM_TEST_VERSION="$(nvm_strip_iojs_prefix "$NVM_PREFIXED_TEST_VERSION")"
# Remove the stuff we're clobbering.