[Tests] nvm install v1 works: get the version from nvm_remote_version, not the ls-remote display
The test took the last `nvm ls-remote` line and trimmed its whitespace, which kept the markers `ls-remote` adds once that version is installed (a trailing ` *`) or current (a leading `->`), so it passed eg `iojs-v1.8.4 *` to `nvm run` as the version. That only resolved because `nvm_ls` interpreted ` *` as a regex; ask `nvm_remote_version` for the version instead. Discovered by Anthropic's OSS Scanner, as bug ANT-2026-HZAFTTUK; the scanner correctly classified it as not a vulnerability.
This commit is contained in:
1 file changed
+1
-1
@@ -5,7 +5,7 @@ die () { echo "$@" ; exit 1; }
|
||||
\. ../../nvm.sh
|
||||
|
||||
NVM_VERSION="v1"
|
||||
NVM_PREFIXED_TEST_VERSION="$(nvm ls-remote "$NVM_VERSION" | tail -1 | sed 's/^[ ]*//;s/[ ]*$//')"
|
||||
NVM_PREFIXED_TEST_VERSION="$(nvm_remote_version "$NVM_VERSION")"
|
||||
NVM_TEST_VERSION="$(nvm_strip_iojs_prefix "$NVM_PREFIXED_TEST_VERSION")"
|
||||
|
||||
# Remove the stuff we're clobbering.
|
||||
|
||||
Reference in new issue
Block a user