Jordan Harband
8df635740e
The check that the resolved version actually matches the request used an unanchored substring match on the raw pattern, so `nvm install 20` could accept `v10.20.0` when a remote list's row was selected by a `v20` in its LTS column and no 20.x rows were present. Match the `v`-prefixed pattern followed by a non-digit against the version instead, the same way `nvm_ls_remote_index_tab` normalizes it, so `20` no longer matches `v10.20.0` or `v200.0.0`, while regex-style requests like `4.*` and `v[68]`, and a trailing dot like `8.`, keep working. This also fixes `iojs-1` and `iojs-3`, which previously resolved to N/A because `iojs-3` is not a substring of `iojs-v3.3.1`. Discovered by Anthropic's OSS Scanner, as bug ANT-2026-7GFFYVJP; the scanner correctly classified it as not a vulnerability.
147 lines
6.3 KiB
Bash
Executable File
147 lines
6.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
cleanup() {
|
|
unset -f nvm_ls_remote nvm_ls_remote_iojs
|
|
}
|
|
|
|
: nvm.sh
|
|
\. ../../../nvm.sh
|
|
|
|
\. ../../common.sh
|
|
|
|
nvm_ls_remote() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_version foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote_iojs() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_version iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
|
|
nvm_ls_remote() {
|
|
if [ -z "$1" ] || ! nvm_is_iojs_version "$1"; then
|
|
echo "test_output"
|
|
echo "more_test_output"
|
|
echo "pattern_received:_$1_"
|
|
fi
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
if [ -z "$1" ] || nvm_is_iojs_version "$1"; then
|
|
echo "test_iojs_output"
|
|
echo "more_iojs_test_output"
|
|
echo "iojs_pattern_received:_$1_"
|
|
fi
|
|
}
|
|
try nvm_remote_version foo
|
|
[ "_$CAPTURED_STDOUT" = "_pattern_received:_foo_" ] \
|
|
|| die "nvm_remote_version foo did not return last line only of nvm_ls_remote foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_iojs_pattern_received:_iojs-foo_" ] \
|
|
|| die "nvm_remote_version iojs-foo did not return last line only of nvm_ls_remote_iojs foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs-foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version iojs
|
|
[ "_$CAPTURED_STDOUT" = "_iojs_pattern_received:__" ] \
|
|
|| die "nvm_remote_version iojs did not return last line only of nvm_ls_remote_iojs; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version stable
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote stable)" ] \
|
|
|| die "nvm_remote_version stable did not return contents of nvm_ls_remote stable; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version stable did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version unstable
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote unstable)" ] \
|
|
|| die "nvm_remote_version unstable did not return contents of nvm_ls_remote unstable; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version unstable did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version node
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote node)" ] \
|
|
|| die "nvm_remote_version node did not return contents of nvm_ls_remote node; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version node did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# Test LTS name rejection (Issue #3474)
|
|
# When nvm_remote_versions returns a line with LTS name in description,
|
|
# nvm_remote_version should reject it if the pattern doesn't match the version number
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1 Argon *"
|
|
}
|
|
try nvm_remote_version Argon
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version Argon should return N/A (LTS name not in version), got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version Argon should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1"
|
|
}
|
|
try nvm_remote_version 4
|
|
[ "_$CAPTURED_STDOUT" = "_v4.9.1" ] || die "nvm_remote_version 4 should return v4.9.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 4 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# A version-like LTS field must not let a request match a different major line
|
|
nvm_remote_versions() {
|
|
echo "v10.20.0 v20 *"
|
|
}
|
|
try nvm_remote_version 20
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 20 should not match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 20 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 10
|
|
[ "_$CAPTURED_STDOUT" = "_v10.20.0 v20 *" ] || die "nvm_remote_version 10 should match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 10 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 10.20
|
|
[ "_$CAPTURED_STDOUT" = "_v10.20.0 v20 *" ] || die "nvm_remote_version 10.20 should match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 10.20 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v10.0.0 v1 *"
|
|
}
|
|
try nvm_remote_version 1
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 1 should not match v10.0.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 1 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "iojs-v3.3.1"
|
|
}
|
|
try nvm_remote_version iojs-3
|
|
[ "_$CAPTURED_STDOUT" = "_iojs-v3.3.1" ] || die "nvm_remote_version iojs-3 should match iojs-v3.3.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs-3 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v8.17.0 Carbon"
|
|
}
|
|
try nvm_remote_version 'v[68]'
|
|
[ "_$CAPTURED_STDOUT" = "_v8.17.0 Carbon" ] || die "nvm_remote_version v[68] should match v8.17.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version v[68] should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 8.
|
|
[ "_$CAPTURED_STDOUT" = "_v8.17.0 Carbon" ] || die "nvm_remote_version 8. should match v8.17.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 8. should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1"
|
|
}
|
|
try nvm_remote_version '4.*'
|
|
[ "_$CAPTURED_STDOUT" = "_v4.9.1" ] || die "nvm_remote_version 4.* should match v4.9.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 4.* should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v20.0.0-rc.1"
|
|
}
|
|
try nvm_remote_version v20.0.0-rc.1
|
|
[ "_$CAPTURED_STDOUT" = "_v20.0.0-rc.1" ] || die "nvm_remote_version v20.0.0-rc.1 should match itself, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version v20.0.0-rc.1 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
cleanup
|