mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-09-15 00:00:08 +08:00
Andres Mejia Sanchez
dd0f702fb1
`~` is a member of RFC 7235 §2.1 `token68`,
and thus of RFC 6750 §2.1 `b64token`,
but the allowlist stripped it,
silently corrupting any opaque Bearer credential containing it:
Bearer mF_9.B5f-4.1JqM~+/= -> Bearer mF_9.B5f-4.1JqM+/=
`Basic` credentials were never affected,
since RFC 4648 §4 base64 cannot emit `~`;
`;` stays stripped, as it belongs to no auth-scheme production.
Cover the charset in the unit test,
and assert the credential reaches the downloader intact via the existing fake-`wget` harness,
which needs no container.
50 lines
1.9 KiB
Bash
Executable File
50 lines
1.9 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
OLDPATH="$PATH"
|
|
WORK="$PWD/nvm_download-wgetauth-work.$$"
|
|
TEST_BIN="$WORK/bin"
|
|
ARGV_LOG="$WORK/argv.log"
|
|
|
|
cleanup() {
|
|
unset -f die cleanup nvm_has_executable
|
|
rm -rf "$WORK"
|
|
export PATH="$OLDPATH"
|
|
}
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
\. ../../../nvm.sh
|
|
|
|
OLDPATH="$PATH"
|
|
|
|
mkdir -p "$TEST_BIN"
|
|
|
|
# fake wget: record each received argument verbatim, then succeed
|
|
{
|
|
echo '#!/bin/sh'
|
|
echo ': > "$ARGV_LOG"'
|
|
echo 'for a in "$@"; do printf "%s\n" "$a" >> "$ARGV_LOG"; done'
|
|
echo 'exit 0'
|
|
} > "$TEST_BIN/wget"
|
|
chmod +x "$TEST_BIN/wget"
|
|
|
|
export ARGV_LOG
|
|
export PATH="$TEST_BIN:$OLDPATH"
|
|
# force the wget path while keeping system tools (sed) available for sanitization
|
|
nvm_has_executable() { [ "$1" != curl ] && command -v "$1" >/dev/null 2>&1; }
|
|
|
|
# given an Authorization credential in NVM_AUTH_HEADER
|
|
# when nvm_download uses the wget path
|
|
NVM_AUTH_HEADER='Bearer test-token' nvm_download "https://nodejs.org/dist/x" -o - || die 'nvm_download (wget) returned nonzero'
|
|
# then wget receives a well-formed Authorization header (with the header name, like the curl path)
|
|
grep -Fxqe '--header' "$ARGV_LOG" || die "wget did not receive --header; got: $(cat "$ARGV_LOG")"
|
|
grep -Fxq 'Authorization: Bearer test-token' "$ARGV_LOG" || die "wget did not receive a well-formed Authorization header; got: $(cat "$ARGV_LOG")"
|
|
|
|
# given a credential using every character RFC 7235 token68 permits, including '~'
|
|
# when nvm_download uses the wget path
|
|
NVM_AUTH_HEADER='Bearer mF_9.B5f-4.1JqM~+/=' nvm_download "https://nodejs.org/dist/x" -o - || die 'nvm_download (wget) returned nonzero for a token68 credential'
|
|
# then it reaches wget byte-for-byte, with no character silently dropped
|
|
grep -Fxq 'Authorization: Bearer mF_9.B5f-4.1JqM~+/=' "$ARGV_LOG" || die "wget did not receive the token68 credential intact; got: $(cat "$ARGV_LOG")"
|
|
|
|
cleanup
|
|
echo "nvm_download wget Authorization header: passed"
|