mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-09-09 00:00:07 +08:00
Andres Mejia Sanchez
dd0f702fb1
`~` is a member of RFC 7235 §2.1 `token68`,
and thus of RFC 6750 §2.1 `b64token`,
but the allowlist stripped it,
silently corrupting any opaque Bearer credential containing it:
Bearer mF_9.B5f-4.1JqM~+/= -> Bearer mF_9.B5f-4.1JqM+/=
`Basic` credentials were never affected,
since RFC 4648 §4 base64 cannot emit `~`;
`;` stays stripped, as it belongs to no auth-scheme production.
Cover the charset in the unit test,
and assert the credential reaches the downloader intact via the existing fake-`wget` harness,
which needs no container.
53 lines
2.4 KiB
Bash
Executable File
53 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
die () { echo "$@" ; exit 1; }
|
|
|
|
\. ../../../nvm.sh
|
|
|
|
set -ex
|
|
|
|
# Test 1: all standard base64 characters (RFC 4648) are preserved
|
|
STANDARD_B64="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
|
|
RESULT=$(nvm_sanitize_auth_header "${STANDARD_B64}")
|
|
[ "${RESULT}" = "${STANDARD_B64}" ] || die "FAIL: standard base64 chars were stripped. Got: '${RESULT}'"
|
|
|
|
# Test 2: all base64url characters (RFC 4648 §5) are preserved
|
|
B64URL="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_="
|
|
RESULT=$(nvm_sanitize_auth_header "${B64URL}")
|
|
[ "${RESULT}" = "${B64URL}" ] || die "FAIL: base64url chars were stripped. Got: '${RESULT}'"
|
|
|
|
# Test 3: a real JWT Bearer token (base64url-encoded header.payload.signature) is preserved
|
|
JWT_TOKEN="Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
|
|
RESULT=$(nvm_sanitize_auth_header "${JWT_TOKEN}")
|
|
[ "${RESULT}" = "${JWT_TOKEN}" ] || die "FAIL: JWT Bearer token chars were stripped. Got: '${RESULT}'"
|
|
|
|
# Test 4: Basic auth (base64-encoded user:pass) is preserved
|
|
BASIC_TOKEN="Basic dXNlcm5hbWU6cGFzc3dvcmQ="
|
|
RESULT=$(nvm_sanitize_auth_header "${BASIC_TOKEN}")
|
|
[ "${RESULT}" = "${BASIC_TOKEN}" ] || die "FAIL: Basic auth base64 token chars were stripped. Got: '${RESULT}'"
|
|
|
|
# Test 5: dangerous shell metacharacters are removed
|
|
DANGEROUS="Bearer token;\`evil\`-cmd \$(inject)"
|
|
RESULT=$(nvm_sanitize_auth_header "${DANGEROUS}")
|
|
case "${RESULT}" in
|
|
*";"*|*"\`"*|*'$'*|*"("*|*")"*)
|
|
die "FAIL: dangerous shell metacharacters survived sanitization. Got: '${RESULT}'"
|
|
;;
|
|
esac
|
|
|
|
# Test 6: every character of RFC 7235 §2.1 `token68` is preserved.
|
|
# token68 = 1*( ALPHA / DIGIT / "-" / "." / "_" / "~" / "+" / "/" ) *"="
|
|
# This is a superset of both base64 and base64url; note the '~', which no
|
|
# base64 variant emits but which an opaque token may legitimately contain.
|
|
TOKEN68="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~+/="
|
|
RESULT=$(nvm_sanitize_auth_header "${TOKEN68}")
|
|
[ "${RESULT}" = "${TOKEN68}" ] || die "FAIL: token68 chars were stripped. Got: '${RESULT}'"
|
|
|
|
# Test 7: the RFC 6750 §2.1 example Bearer token, extended with the remaining
|
|
# valid `b64token` characters, survives intact.
|
|
B64TOKEN="Bearer mF_9.B5f-4.1JqM~+/="
|
|
RESULT=$(nvm_sanitize_auth_header "${B64TOKEN}")
|
|
[ "${RESULT}" = "${B64TOKEN}" ] || die "FAIL: b64token chars were stripped. Got: '${RESULT}'"
|
|
|
|
echo "All nvm_sanitize_auth_header tests passed"
|