Jordan Harband
4a1f7d2875
`nvm_get_mirror` accepts `user:password@` in `$NVM_NODEJS_ORG_MIRROR` and `$NVM_IOJS_ORG_MIRROR`, but `nvm_download_artifact` printed the full tarball URL in its "Downloading", "download from ... failed", and "HTTP 404 at URL" messages, and `nvm debug` printed both mirror variables as-is, so the credentials showed up in terminal output and build logs. Add `nvm_sanitize_url`, which replaces the userinfo part of any URL with `***@`, and use it in those messages. The download itself still uses the full URL, so authenticating to the mirror keeps working. The README now notes that `$NVM_AUTH_HEADER` is the recommended way to authenticate to a mirror Discovered by Anthropic's OSS Scanner, as ANT-2026-X03SZ7C6; the scanner reported it as a vulnerability, but it is not one.
32 lines
1.3 KiB
Bash
Executable File
32 lines
1.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
die () { echo "$@" ; exit 1; }
|
|
|
|
\. ../../../nvm.sh
|
|
|
|
check() {
|
|
ACTUAL="$(nvm_sanitize_url "${1}")"
|
|
[ "${ACTUAL}" = "${2}" ] || die "nvm_sanitize_url '${1}': expected >${2}<, got >${ACTUAL}<"
|
|
}
|
|
|
|
# URLs without userinfo are unchanged
|
|
check '' ''
|
|
check 'https://nodejs.org/dist' 'https://nodejs.org/dist'
|
|
check 'https://nodejs.org' 'https://nodejs.org'
|
|
check 'http://127.0.0.1:8080/dist/v20.0.0/node-v20.0.0.tar.xz' 'http://127.0.0.1:8080/dist/v20.0.0/node-v20.0.0.tar.xz'
|
|
check 'https://[::1]:8080/dist' 'https://[::1]:8080/dist'
|
|
check 'https://nodejs.org/a@b/dist' 'https://nodejs.org/a@b/dist'
|
|
|
|
# userinfo is masked
|
|
check 'https://user:pw@nexus.example.com/repository/nodejs-dist' 'https://***@nexus.example.com/repository/nodejs-dist'
|
|
check 'https://user:pw@nexus.example.com' 'https://***@nexus.example.com'
|
|
check 'https://token@nexus.example.com:8443/dist' 'https://***@nexus.example.com:8443/dist'
|
|
check 'http://user:p%40w@[::1]:8080/dist' 'http://***@[::1]:8080/dist'
|
|
# everything up to the last `@` before the path is userinfo; an `@` in the path is kept
|
|
check 'https://user:p@w@nexus.example.com/a@b' 'https://***@nexus.example.com/a@b'
|
|
|
|
# every URL in multiline text is masked
|
|
check 'URL:http://user:pw@a.example.com/x [1/1]
|
|
https://user:pw@b.example.com/y' 'URL:http://***@a.example.com/x [1/1]
|
|
https://***@b.example.com/y'
|