Jordan Harband
6bbbf3e8d3
The httpbin check sends `$NVM_AUTH_HEADER` to `http://127.0.0.1/bearer` without configuring a mirror. Set `$NVM_NODEJS_ORG_MIRROR` to that host, as a real user of the header would, so the check keeps exercising the header once it is only sent to URLs under a mirror Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one.
43 lines
1.8 KiB
Bash
Executable File
43 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
cleanup () {
|
|
unset -f die cleanup
|
|
docker rm -f httpbin >/dev/null 2>&1 || true
|
|
}
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
: nvm.sh
|
|
\. ../../../nvm.sh
|
|
|
|
set -ex
|
|
|
|
# nvm_download install.sh
|
|
nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh" >/dev/null || die "nvm_download unable to download install.sh"
|
|
|
|
# nvm_download should fail to download wrong_install.sh
|
|
! nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/wrong_install.sh" >/dev/null || die "nvm_download should fail to download no existing file"
|
|
|
|
# the auth header checks need a local httpbin container; retry the pull, and
|
|
# skip (rather than fail) if the image cannot be pulled or run, so a transient
|
|
# Docker registry outage does not fail the suite
|
|
httpbin_pulled=0
|
|
for i in 1 2 3 4 5; do
|
|
if docker pull kennethreitz/httpbin; then httpbin_pulled=1; break; fi
|
|
echo "docker pull httpbin failed, attempt $i/5"
|
|
sleep $((i * 5))
|
|
done
|
|
if [ "${httpbin_pulled}" = 1 ] && SHELL=bash docker run -d --name httpbin -p 80:80 kennethreitz/httpbin; then
|
|
sleep 1 # wait for httpbin to start
|
|
# nvm_download should pass when calling with auth header
|
|
NVM_NODEJS_ORG_MIRROR="http://127.0.0.1" NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /dev/null || die 'nvm_download with auth header should send correctly'
|
|
# nvm_download should fail when calling without auth header
|
|
nvm_download "http://127.0.0.1/bearer" > /dev/null && die 'nvm_download with no auth header should not send the header and should fail'
|
|
else
|
|
echo 'skipping auth header checks: unable to pull or run httpbin'
|
|
fi
|
|
|
|
# ensure quoted extra args remain quoted
|
|
nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh" -o "; die quoted-command-not-quoted" || die 'command failed'
|
|
|
|
cleanup
|