[Fix] nvm_ls_remote_index_tab, nvm_remote_version, nvm_ls_cached: pass the version pattern to grep with -e
The requested version pattern was passed to grep as a bare argument, so a pattern starting with `-` was parsed as grep options instead. That pattern can come from a `.nvmrc` in a repository the user cloned, or, for implicit aliases like `node` and `stable`, from the version column of the mirror's index.tab. A pattern like `-Rohenpm_[A-Za-z0-9]*` made GNU grep ignore the version list on stdin and search the current directory recursively, following symlinks, so a string from a local file (such as an npm token in a `.npmrc`) was taken as the "version", printed, and requested from the mirror in the download URLs; since the version list was never read, this also worked with `--offline`. Pass the pattern after `-e` in `nvm_ls_remote_index_tab` (which also covers `nvm_ls_remote`, `nvm_ls_remote_iojs`, and `nvm_remote_versions`), in the post-check in `nvm_remote_version`, and in `nvm_ls_cached`, so a leading `-` is just part of a pattern that matches no version. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-EN9DM7WC.
This commit is contained in:
2 files changed
+69
-3
No files matched your search
@@ -1324,7 +1324,7 @@ nvm_remote_version() {
|
||||
local VERSION_NUM
|
||||
VERSION_NUM="$(nvm_echo "${VERSION}" | command awk '{print $1}')"
|
||||
# the `v` prefix and the trailing non-digit keep `20` from matching `v10.20.0` or `v200.0.0`
|
||||
if ! nvm_echo "${VERSION_NUM} " | nvm_grep -q "$(nvm_ensure_version_prefix "${PATTERN%.}")[^0-9]"; then
|
||||
if ! nvm_echo "${VERSION_NUM} " | nvm_grep -q -e "$(nvm_ensure_version_prefix "${PATTERN%.}")[^0-9]"; then
|
||||
VERSION='N/A'
|
||||
fi
|
||||
fi
|
||||
@@ -2813,7 +2813,7 @@ EOF
|
||||
}
|
||||
prev=$10;
|
||||
}' \
|
||||
| nvm_grep -w "${PATTERN:-.*}" \
|
||||
| nvm_grep -w -e "${PATTERN:-.*}" \
|
||||
| $SORT_COMMAND; } << EOF
|
||||
$VERSION_LIST
|
||||
EOF
|
||||
@@ -4600,7 +4600,7 @@ nvm_ls_cached() {
|
||||
fi
|
||||
} \
|
||||
| command sed 's/^node-//' \
|
||||
| nvm_grep -w "${NVM_CACHED_PATTERN}" \
|
||||
| nvm_grep -w -e "${NVM_CACHED_PATTERN}" \
|
||||
| nvm_grep -v "^${NVM_CACHED_RELEASE}-" \
|
||||
| nvm_filter_installed_versions \
|
||||
| nvm_sort_versions
|
||||
|
||||
Reference in new issue
Block a user