Jordan Harband
cbd8f8e920
io.js only released v1 through v3, but its version list was downloaded and searched for every pattern, including ones like `0.12` or `20` that can only ever match node versions. Besides the needless index.tab download on every such `nvm install`, io.js's "no match" status was returned even when node had matches, so `nvm ls-remote 20` printed node's versions and then exited 3. Patterns whose major is 0 or 4+ now only consult node's list, so `nvm ls-remote` exits 0 for them when node has matching versions. The listed and resolved versions are unchanged Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.
172 lines
7.5 KiB
Bash
Executable File
172 lines
7.5 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
cleanup() {
|
|
unset -f nvm_ls_remote nvm_ls_remote_iojs
|
|
}
|
|
|
|
: nvm.sh
|
|
\. ../../../nvm.sh
|
|
|
|
\. ../../common.sh
|
|
|
|
nvm_ls_remote() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_version foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote_iojs() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_version iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
|
|
nvm_ls_remote() {
|
|
if [ -z "$1" ] || ! nvm_is_iojs_version "$1"; then
|
|
echo "test_output"
|
|
echo "more_test_output"
|
|
echo "pattern_received:_$1_"
|
|
fi
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
if [ -z "$1" ] || nvm_is_iojs_version "$1"; then
|
|
echo "test_iojs_output"
|
|
echo "more_iojs_test_output"
|
|
echo "iojs_pattern_received:_$1_"
|
|
fi
|
|
}
|
|
try nvm_remote_version foo
|
|
[ "_$CAPTURED_STDOUT" = "_pattern_received:_foo_" ] \
|
|
|| die "nvm_remote_version foo did not return last line only of nvm_ls_remote foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_iojs_pattern_received:_iojs-foo_" ] \
|
|
|| die "nvm_remote_version iojs-foo did not return last line only of nvm_ls_remote_iojs foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs-foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version iojs
|
|
[ "_$CAPTURED_STDOUT" = "_iojs_pattern_received:__" ] \
|
|
|| die "nvm_remote_version iojs did not return last line only of nvm_ls_remote_iojs; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version stable
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote stable)" ] \
|
|
|| die "nvm_remote_version stable did not return contents of nvm_ls_remote stable; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version stable did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version unstable
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote unstable)" ] \
|
|
|| die "nvm_remote_version unstable did not return contents of nvm_ls_remote unstable; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version unstable did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version node
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote node)" ] \
|
|
|| die "nvm_remote_version node did not return contents of nvm_ls_remote node; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version node did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# io.js versions do not sort after newer node versions, even when node's list does not include v4.0.0
|
|
nvm_ls_remote() {
|
|
case "${1-}" in
|
|
20 | v20.0.0) echo "v20.0.0" ;;
|
|
0.12) echo "v0.12.18" ;;
|
|
*) echo "N/A"; return 3 ;;
|
|
esac
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
echo "iojs-v3.3.1"
|
|
}
|
|
for PATTERN in 20 v20.0.0; do
|
|
try nvm_remote_version "${PATTERN}"
|
|
[ "_$CAPTURED_STDOUT" = "_v20.0.0" ] || die "nvm_remote_version ${PATTERN} should return v20.0.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version ${PATTERN} should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
done
|
|
|
|
# io.js only released v1 through v3, so it is not consulted for any other major
|
|
try nvm_remote_version 0.12
|
|
[ "_$CAPTURED_STDOUT" = "_v0.12.18" ] || die "nvm_remote_version 0.12 should return v0.12.18, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 0.12 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
try nvm_remote_version 99
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 99 should return N/A, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 99 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
# Test LTS name rejection (Issue #3474)
|
|
# When nvm_remote_versions returns a line with LTS name in description,
|
|
# nvm_remote_version should reject it if the pattern doesn't match the version number
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1 Argon *"
|
|
}
|
|
try nvm_remote_version Argon
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version Argon should return N/A (LTS name not in version), got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version Argon should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1"
|
|
}
|
|
try nvm_remote_version 4
|
|
[ "_$CAPTURED_STDOUT" = "_v4.9.1" ] || die "nvm_remote_version 4 should return v4.9.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 4 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# A version-like LTS field must not let a request match a different major line
|
|
nvm_remote_versions() {
|
|
echo "v10.20.0 v20 *"
|
|
}
|
|
try nvm_remote_version 20
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 20 should not match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 20 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 10
|
|
[ "_$CAPTURED_STDOUT" = "_v10.20.0 v20 *" ] || die "nvm_remote_version 10 should match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 10 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 10.20
|
|
[ "_$CAPTURED_STDOUT" = "_v10.20.0 v20 *" ] || die "nvm_remote_version 10.20 should match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 10.20 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v10.0.0 v1 *"
|
|
}
|
|
try nvm_remote_version 1
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 1 should not match v10.0.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 1 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "iojs-v3.3.1"
|
|
}
|
|
try nvm_remote_version iojs-3
|
|
[ "_$CAPTURED_STDOUT" = "_iojs-v3.3.1" ] || die "nvm_remote_version iojs-3 should match iojs-v3.3.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs-3 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v8.17.0 Carbon"
|
|
}
|
|
try nvm_remote_version 'v[68]'
|
|
[ "_$CAPTURED_STDOUT" = "_v8.17.0 Carbon" ] || die "nvm_remote_version v[68] should match v8.17.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version v[68] should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 8.
|
|
[ "_$CAPTURED_STDOUT" = "_v8.17.0 Carbon" ] || die "nvm_remote_version 8. should match v8.17.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 8. should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1"
|
|
}
|
|
try nvm_remote_version '4.*'
|
|
[ "_$CAPTURED_STDOUT" = "_v4.9.1" ] || die "nvm_remote_version 4.* should match v4.9.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 4.* should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v20.0.0-rc.1"
|
|
}
|
|
try nvm_remote_version v20.0.0-rc.1
|
|
[ "_$CAPTURED_STDOUT" = "_v20.0.0-rc.1" ] || die "nvm_remote_version v20.0.0-rc.1 should match itself, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version v20.0.0-rc.1 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
cleanup
|