Files
nvm/test/fast/Unit tests
Jordan Harband bce663e387 [Fix] nvm_ls_remote_index_tab, nvm_remote_version, nvm_ls_cached: pass the version pattern to grep with -e
The requested version pattern was passed to grep as a bare argument,
so a pattern starting with `-` was parsed as grep options instead.
That pattern can come from a `.nvmrc` in a repository the user cloned,
or, for implicit aliases like `node` and `stable`,
from the version column of the mirror's index.tab.
A pattern like `-Rohenpm_[A-Za-z0-9]*` made GNU grep ignore the version list on stdin and search the current directory recursively,
following symlinks, so a string from a local file
(such as an npm token in a `.npmrc`) was taken as the "version", printed,
and requested from the mirror in the download URLs;
since the version list was never read, this also worked with `--offline`.
Pass the pattern after `-e` in `nvm_ls_remote_index_tab`
(which also covers `nvm_ls_remote`, `nvm_ls_remote_iojs`, and `nvm_remote_versions`),
in the post-check in `nvm_remote_version`, and in `nvm_ls_cached`,
so a leading `-` is just part of a pattern that matches no version.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-EN9DM7WC.
2026-10-16 22:28:12 -07:00
..