Jordan Harband
59e008fd62
io.js versions were inserted into node's version list immediately before the `v4.0.0` line. Whenever node's filtered list did not contain that exact line, every io.js version was appended after all node versions, including newer ones, so `nvm_remote_version`'s `tail -1` could pick an io.js version over the latest matching node version. Node's list is sorted, so it is now split at the first version with a nonzero major, which keeps io.js versions between node v0.x and node v4+ regardless of which node versions the pattern matched Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.
118 lines
4.3 KiB
Bash
Executable File
118 lines
4.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
cleanup() {
|
|
unset -f nvm_ls_remote nvm_ls_remote_iojs
|
|
}
|
|
|
|
: nvm.sh
|
|
\. ../../../nvm.sh
|
|
|
|
\. ../../common.sh
|
|
|
|
try_err nvm_remote_versions stable
|
|
EXPECTED_OUTPUT="Implicit aliases are not supported in nvm_remote_versions."
|
|
[ "_$CAPTURED_STDERR" = "_$EXPECTED_OUTPUT" ] || die "implicit alias 'stable' did not error out with correct message, got $CAPTURED_STDERR"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_1" ] || die "implicit alias 'stable' did not exit with code 1, got $CAPTURED_EXIT_CODE"
|
|
|
|
try_err nvm_remote_versions unstable
|
|
EXPECTED_OUTPUT="Implicit aliases are not supported in nvm_remote_versions."
|
|
[ "_$CAPTURED_STDERR" = "_$EXPECTED_OUTPUT" ] || die "implicit alias 'unstable' did not error out with correct message, got $CAPTURED_STDERR"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_1" ] || die "implicit alias 'unstable' did not exit with code 1, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_versions foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote_iojs() {
|
|
echo "N/A"
|
|
}
|
|
try nvm_remote_versions iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_N/A" ] || die "nonexistent version did not report N/A"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_3" ] || die "nonexistent version did not exit with code 3, got $CAPTURED_EXIT_CODE"
|
|
|
|
|
|
nvm_ls_remote() {
|
|
echo "test output"
|
|
echo "more test output"
|
|
echo "pattern received: _$1_"
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
echo "test iojs output"
|
|
echo "more iojs test output"
|
|
echo "iojs pattern received: _$1_"
|
|
}
|
|
|
|
try nvm_remote_versions foo
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote foo)
|
|
$(nvm_ls_remote_iojs foo)" ] \
|
|
|| die "nvm_remote_versions foo did not return contents of nvm_ls_remote foo combined with nvm_ls_remote_iojs foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_versions node
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote)" ] \
|
|
|| die "nvm_remote_versions node did not return contents of nvm_ls_remote; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions node did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_versions iojs-foo
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote iojs-foo)
|
|
$(nvm_ls_remote_iojs iojs-foo)" ] \
|
|
|| die "nvm_remote_versions iojs-foo did not return contents of nvm_ls_remote iojs-foo combined with nvm_ls_remote_iojs iojs-foo; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions iojs-foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
try nvm_remote_versions iojs
|
|
[ "_$CAPTURED_STDOUT" = "_$(nvm_ls_remote_iojs)" ] \
|
|
|| die "nvm_remote_versions iojs did not return contents of nvm_ls_remote_iojs; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions iojs did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
# io.js versions sort after node v0.x and before node v4+, even when node's list has no v4.0.0
|
|
nvm_ls_remote() {
|
|
echo "v0.10.48"
|
|
echo "v0.12.18"
|
|
echo "v4.1.0"
|
|
echo "v20.0.0 Iron *"
|
|
}
|
|
nvm_ls_remote_iojs() {
|
|
echo "iojs-v1.0.0"
|
|
echo "iojs-v3.3.1"
|
|
}
|
|
try nvm_remote_versions foo
|
|
[ "_$CAPTURED_STDOUT" = "_v0.10.48
|
|
v0.12.18
|
|
iojs-v1.0.0
|
|
iojs-v3.3.1
|
|
v4.1.0
|
|
v20.0.0 Iron *" ] \
|
|
|| die "nvm_remote_versions foo did not put io.js versions between node v0.x and node v4+; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote() {
|
|
echo "v4.1.0"
|
|
echo "v20.0.0 Iron *"
|
|
}
|
|
try nvm_remote_versions foo
|
|
[ "_$CAPTURED_STDOUT" = "_iojs-v1.0.0
|
|
iojs-v3.3.1
|
|
v4.1.0
|
|
v20.0.0 Iron *" ] \
|
|
|| die "nvm_remote_versions foo did not put io.js versions before node v4+ when node has no v0.x; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
nvm_ls_remote() {
|
|
echo "v0.10.48"
|
|
echo "v0.12.18"
|
|
}
|
|
try nvm_remote_versions foo
|
|
[ "_$CAPTURED_STDOUT" = "_v0.10.48
|
|
v0.12.18
|
|
iojs-v1.0.0
|
|
iojs-v3.3.1" ] \
|
|
|| die "nvm_remote_versions foo did not put io.js versions after node v0.x when node has no v4+; got $CAPTURED_STDOUT"
|
|
[ "_$CAPTURED_EXIT_CODE" = "_0" ] || die "nvm_remote_versions foo did not exit with 0, got $CAPTURED_EXIT_CODE"
|
|
|
|
cleanup
|