273345896
/
nvm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[Fix] `nvm_get_mirror`: disallow some non-URL characters 

This should be improved in the future, but is fine for now
Jordan Harband 2023-11-01 21:01:28 -07:00
parent ef7fc2f2c0
commit d02ddcac2c
No known key found for this signature in database
GPG Key ID: 9F6A681E35EF8B56
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
nvm.sh
View File

@ -2023,14 +2023,25 @@ nvm_is_merged_node_version() {
}
nvm_get_mirror() {
local NVM_MIRROR
NVM_MIRROR=''
case "${1}-${2}" in
node-std) nvm_echo "${NVM_NODEJS_ORG_MIRROR:-https://nodejs.org/dist}" ;;
iojs-std) nvm_echo "${NVM_IOJS_ORG_MIRROR:-https://iojs.org/dist}" ;;
node-std) NVM_MIRROR="${NVM_NODEJS_ORG_MIRROR:-https://nodejs.org/dist}" ;;
iojs-std) NVM_MIRROR="${NVM_IOJS_ORG_MIRROR:-https://iojs.org/dist}" ;;
*)
nvm_err 'unknown type of node.js or io.js release'
return 1
;;
esac
case "${NVM_MIRROR}" in
*\`* | *\\* | *\'* | *\(* )
nvm_err '$NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL'
return 2
;;
esac
nvm_echo "${NVM_MIRROR}"
}
# args: os, prefixed version, version, tarball, extract directory

8
test/fast/Unit tests/nvm_get_mirror
View File

@ -30,3 +30,11 @@ unset NVM_NODEJS_ORG_MIRROR
NVM_IOJS_ORG_MIRROR="test://domain"
[ "$(nvm_get_mirror iojs std)" = "test://domain" ] || die "iojs-std mirror should respect NVM_IOJS_ORG_MIRROR"
unset NVM_IOJS_ORG_MIRROR
NVM_NODEJS_ORG_MIRROR='`do something bad`'
! nvm_get_mirror node std || die 'NVM_NODEJS_ORG_MIRROR errors with command injection attempt'
[ "$(nvm_get_mirror node std)" = "" ] || die 'NVM_NODEJS_ORG_MIRROR is protected against command injection'
NVM_IOJS_ORG_MIRROR='`do something bad`'
! nvm_get_mirror iojs std || die 'NVM_IOJS_ORG_MIRROR errors with command injection attempt'
[ "$(nvm_get_mirror iojs std)" = "" ] || die 'NVM_IOJS_ORG_MIRROR is protected against command injection'