Jordan Harband
59e008fd62
io.js versions were inserted into node's version list immediately before the `v4.0.0` line. Whenever node's filtered list did not contain that exact line, every io.js version was appended after all node versions, including newer ones, so `nvm_remote_version`'s `tail -1` could pick an io.js version over the latest matching node version. Node's list is sorted, so it is now split at the first version with a nonzero major, which keeps io.js versions between node v0.x and node v4+ regardless of which node versions the pattern matched Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.
163 lines
6.9 KiB
Bash
Executable File
163 lines
6.9 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
cleanup() {
|
|
unset -f nvm_ls_remote nvm_ls_remote_iojs
|
|
}
|
|
|
|
: nvm.sh
|
|
\. ../../../nvm.sh
|
|
|
|
\. ../../common.sh
|
|
|
|
nvm_ls_remote() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_version foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote_iojs() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_version iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
|
|
nvm_ls_remote() {
|
|
if [ -z "$1" ] || ! nvm_is_iojs_version "$1"; then
|
|
echo "test_output"
|
|
echo "more_test_output"
|
|
echo "pattern_received:_$1_"
|
|
fi
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
if [ -z "$1" ] || nvm_is_iojs_version "$1"; then
|
|
echo "test_iojs_output"
|
|
echo "more_iojs_test_output"
|
|
echo "iojs_pattern_received:_$1_"
|
|
fi
|
|
}
|
|
try nvm_remote_version foo
|
|
[ "_$CAPTURED_STDOUT" = "_pattern_received:_foo_" ] \
|
|
|| die "nvm_remote_version foo did not return last line only of nvm_ls_remote foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_iojs_pattern_received:_iojs-foo_" ] \
|
|
|| die "nvm_remote_version iojs-foo did not return last line only of nvm_ls_remote_iojs foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs-foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version iojs
|
|
[ "_$CAPTURED_STDOUT" = "_iojs_pattern_received:__" ] \
|
|
|| die "nvm_remote_version iojs did not return last line only of nvm_ls_remote_iojs; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version stable
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote stable)" ] \
|
|
|| die "nvm_remote_version stable did not return contents of nvm_ls_remote stable; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version stable did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version unstable
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote unstable)" ] \
|
|
|| die "nvm_remote_version unstable did not return contents of nvm_ls_remote unstable; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version unstable did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version node
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote node)" ] \
|
|
|| die "nvm_remote_version node did not return contents of nvm_ls_remote node; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version node did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# io.js versions do not sort after newer node versions, even when node's list does not include v4.0.0
|
|
nvm_ls_remote() {
|
|
case "${1-}" in
|
|
20 | v20.0.0) echo "v20.0.0" ;;
|
|
*) echo "N/A"; return 3 ;;
|
|
esac
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
echo "iojs-v3.3.1"
|
|
}
|
|
for PATTERN in 20 v20.0.0; do
|
|
try nvm_remote_version "${PATTERN}"
|
|
[ "_$CAPTURED_STDOUT" = "_v20.0.0" ] || die "nvm_remote_version ${PATTERN} should return v20.0.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version ${PATTERN} should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
done
|
|
|
|
# Test LTS name rejection (Issue #3474)
|
|
# When nvm_remote_versions returns a line with LTS name in description,
|
|
# nvm_remote_version should reject it if the pattern doesn't match the version number
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1 Argon *"
|
|
}
|
|
try nvm_remote_version Argon
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version Argon should return N/A (LTS name not in version), got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version Argon should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1"
|
|
}
|
|
try nvm_remote_version 4
|
|
[ "_$CAPTURED_STDOUT" = "_v4.9.1" ] || die "nvm_remote_version 4 should return v4.9.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 4 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# A version-like LTS field must not let a request match a different major line
|
|
nvm_remote_versions() {
|
|
echo "v10.20.0 v20 *"
|
|
}
|
|
try nvm_remote_version 20
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 20 should not match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 20 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 10
|
|
[ "_$CAPTURED_STDOUT" = "_v10.20.0 v20 *" ] || die "nvm_remote_version 10 should match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 10 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 10.20
|
|
[ "_$CAPTURED_STDOUT" = "_v10.20.0 v20 *" ] || die "nvm_remote_version 10.20 should match v10.20.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 10.20 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v10.0.0 v1 *"
|
|
}
|
|
try nvm_remote_version 1
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nvm_remote_version 1 should not match v10.0.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nvm_remote_version 1 should exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "iojs-v3.3.1"
|
|
}
|
|
try nvm_remote_version iojs-3
|
|
[ "_$CAPTURED_STDOUT" = "_iojs-v3.3.1" ] || die "nvm_remote_version iojs-3 should match iojs-v3.3.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version iojs-3 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v8.17.0 Carbon"
|
|
}
|
|
try nvm_remote_version 'v[68]'
|
|
[ "_$CAPTURED_STDOUT" = "_v8.17.0 Carbon" ] || die "nvm_remote_version v[68] should match v8.17.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version v[68] should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_version 8.
|
|
[ "_$CAPTURED_STDOUT" = "_v8.17.0 Carbon" ] || die "nvm_remote_version 8. should match v8.17.0, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 8. should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v4.9.1"
|
|
}
|
|
try nvm_remote_version '4.*'
|
|
[ "_$CAPTURED_STDOUT" = "_v4.9.1" ] || die "nvm_remote_version 4.* should match v4.9.1, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version 4.* should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_remote_versions() {
|
|
echo "v20.0.0-rc.1"
|
|
}
|
|
try nvm_remote_version v20.0.0-rc.1
|
|
[ "_$CAPTURED_STDOUT" = "_v20.0.0-rc.1" ] || die "nvm_remote_version v20.0.0-rc.1 should match itself, got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_version v20.0.0-rc.1 should exit with code 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
cleanup
|