[Fix] nvm_nvmrc_invalid_msg: respect --silent
The invalid `.nvmrc` message, which includes the file's parsed content, was printed even when `NVM_SILENT` was set (eg, by `nvm use --silent`), unlike nvm's other `.nvmrc` messages. It is now suppressed there too; the exit status still reports the invalid file.
This is hardening, not a vulnerability fix: since 67268ebc (the fix for ANT-2026-G9REVGKT), the content of a symlinked `.nvmrc` is never shown, so this message only ever shows the content of a regular `.nvmrc`.
Found by Anthropic's OSS Scanner while analyzing ANT-2026-G9REVGKT.
This commit is contained in:
2 files changed
+25
No files matched your search
@@ -880,6 +880,10 @@ nvm_find_nvmrc() {
|
||||
}
|
||||
|
||||
nvm_nvmrc_invalid_msg() {
|
||||
if [ "${NVM_SILENT:-0}" -eq 1 ]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
local error_text
|
||||
error_text="invalid .nvmrc!
|
||||
all non-commented content (anything after # is a comment) must be either:
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
#!/bin/sh
|
||||
|
||||
die () { echo "$@" ; exit 1; }
|
||||
|
||||
: nvm.sh
|
||||
\. ../../../nvm.sh
|
||||
|
||||
\. ../../common.sh
|
||||
|
||||
try_err nvm_process_nvmrc_content 'secret=hunter2'
|
||||
[ "${CAPTURED_EXIT_CODE}" = '1' ] || die "expected exit code 1; got ${CAPTURED_EXIT_CODE}"
|
||||
case "${CAPTURED_STDERR}" in
|
||||
*'invalid .nvmrc!'*'secret=hunter2'*) ;;
|
||||
*) die "expected the invalid .nvmrc message; got >${CAPTURED_STDERR}<" ;;
|
||||
esac
|
||||
|
||||
NVM_SILENT=1
|
||||
try_err nvm_process_nvmrc_content 'secret=hunter2'
|
||||
unset NVM_SILENT
|
||||
[ "${CAPTURED_EXIT_CODE}" = '1' ] || die "expected exit code 1 with NVM_SILENT=1; got ${CAPTURED_EXIT_CODE}"
|
||||
[ -z "${CAPTURED_STDERR}" ] || die "expected no output with NVM_SILENT=1; got >${CAPTURED_STDERR}<"
|
||||
Reference in new issue
Block a user