Jordan Harband
aa0572b7c4
`nvm_normalize_lts` matched `lts/-N` with a glob that only pins the first digit after `lts/-`, then evaluated the rest inside `$((N+1))`. bash and zsh evaluate a variable's contents as an arithmetic expression there, including command substitutions in array subscripts, so a name like `lts/-10*path[$(cmd)1]` ran `cmd`. Such a name reaches this function from `nvm alias`, `nvm use`, `nvm install`, and `.nvmrc`, and also from LTS alias files written from a mirror's `index.tab`, which are resolved whenever `lts/*` or that codename is used. The version column of a mirror's `index.tab` was used verbatim: printed by `nvm ls-remote` and `nvm version-remote`, matched against patterns, and stored as the target of `lts/*` codename aliases. A hostile or compromised mirror could thus persist such a payload into `$NVM_DIR/alias/lts/`, where it is replayed later by `nvm alias` and alias resolution without the mirror being involved, and could put terminal escape sequences on the user's screen. `nvm_normalize_lts` now takes everything after `lts/-` with parameter expansion and passes the name through unchanged unless it is all digits, before any arithmetic happens. `lts/-1` through `lts/-N`, and the error when there are not that many LTS lines, behave as before; malformed offsets like `lts/-1x` or `lts/-10+1` are now returned unchanged in every shell, instead of erroring in dash or being evaluated in bash and zsh. This also drops the `$?` check after the arithmetic, which could never fire. `nvm_ls_remote_index_tab` now skips the header and keeps only rows whose version is `vX.Y.Z`, optionally followed by a `-` prerelease suffix of letters, digits, `.` and `-`, before anything is printed, stored, or matched. The check runs on the raw column, before the `iojs-` prefix is added. Every row of the current nodejs.org, nodejs.org nightly, and iojs.org index files passes, including `rc`, `nightly`, and `v8-canary` versions. Discovered by Anthropic's OSS Scanner, as vulnerabilities ANT-2026-0GXXE91V and ANT-2026-31ZIEY85.
57 lines
1.8 KiB
Bash
Executable File
57 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
WORK="$PWD/normalize_lts-non-numeric-work.$$"
|
|
export HOME="$WORK/home"
|
|
export NVM_DIR="$HOME/.nvm"
|
|
MARKER='nvm_normalize_lts_pwned'
|
|
|
|
cleanup() {
|
|
unset -f die cleanup
|
|
rm -rf "$WORK"
|
|
rm -f "${MARKER}"
|
|
}
|
|
die () { echo "$@" ; cleanup ; exit 1; }
|
|
|
|
mkdir -p "$NVM_DIR/alias/lts"
|
|
rm -f "${MARKER}"
|
|
|
|
: nvm.sh
|
|
\. ../../../nvm.sh
|
|
|
|
echo 'lts/iron' > "$NVM_DIR/alias/lts/*"
|
|
echo 'v18.0.0' > "$NVM_DIR/alias/lts/hydrogen"
|
|
echo 'v20.0.0' > "$NVM_DIR/alias/lts/iron"
|
|
|
|
ACTUAL="$(nvm_normalize_lts 'lts/-1')"
|
|
EXPECTED='lts/hydrogen'
|
|
[ "${ACTUAL}" = "${EXPECTED}" ] || die "lts/-1: expected >${EXPECTED}<, got >${ACTUAL}<"
|
|
|
|
ACTUAL="$(nvm_normalize_lts 'lts/-1x')"
|
|
EXPECTED='lts/-1x'
|
|
[ "${ACTUAL}" = "${EXPECTED}" ] || die "lts/-1x: expected >${EXPECTED}<, got >${ACTUAL}<"
|
|
|
|
ACTUAL="$(nvm_normalize_lts 'lts/-1-1')"
|
|
EXPECTED='lts/-1-1'
|
|
[ "${ACTUAL}" = "${EXPECTED}" ] || die "lts/-1-1: expected >${EXPECTED}<, got >${ACTUAL}<"
|
|
|
|
ACTUAL="$(nvm_normalize_lts 'lts/-10+1')"
|
|
EXPECTED='lts/-10+1'
|
|
[ "${ACTUAL}" = "${EXPECTED}" ] || die "lts/-10+1: expected >${EXPECTED}<, got >${ACTUAL}<"
|
|
|
|
# bash and zsh run command substitutions in array subscripts during arithmetic evaluation
|
|
INJECTED="lts/-10*path[\$(touch ${MARKER})1]"
|
|
ACTUAL="$(nvm_normalize_lts "${INJECTED}" 2>/dev/null)"
|
|
[ ! -e "${MARKER}" ] || die "nvm_normalize_lts evaluated ${INJECTED}"
|
|
[ "${ACTUAL}" = "${INJECTED}" ] || die "${INJECTED}: expected it unchanged, got >${ACTUAL}<"
|
|
|
|
nvm_alias "${INJECTED}" >/dev/null 2>&1
|
|
[ ! -e "${MARKER}" ] || die "nvm_alias evaluated ${INJECTED}"
|
|
|
|
# an alias file written by an older nvm from a hostile mirror's index.tab
|
|
echo "${INJECTED}" > "$NVM_DIR/alias/lts/iron"
|
|
nvm_resolve_alias 'lts/*' >/dev/null 2>&1
|
|
[ ! -e "${MARKER}" ] || die "nvm_resolve_alias evaluated a stored ${INJECTED}"
|
|
|
|
cleanup
|
|
echo "nvm_normalize_lts non-numeric offset: passed"
|