node/nvm
1
0
Fork 0
mirror of https://github.com/nvm-sh/nvm.git synced 2025-09-27 20:21:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Fix] nvm_get_mirror: disallow some non-URL characters

Browse Source 
This should be improved in the future, but is fine for now
This commit is contained in:
Jordan Harband
2023-11-01 21:01:28 -07:00
parent ef7fc2f2c0
commit d02ddcac2c
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
test/fast/Unit tests/nvm_get_mirror
View File

@@ -30,3 +30,11 @@ unset NVM_NODEJS_ORG_MIRROR
NVM_IOJS_ORG_MIRROR="test://domain"
[ "$(nvm_get_mirror iojs std)" = "test://domain" ] || die "iojs-std mirror should respect NVM_IOJS_ORG_MIRROR"
unset NVM_IOJS_ORG_MIRROR
NVM_NODEJS_ORG_MIRROR='`do something bad`'
! nvm_get_mirror node std || die 'NVM_NODEJS_ORG_MIRROR errors with command injection attempt'
[ "$(nvm_get_mirror node std)" = "" ] || die 'NVM_NODEJS_ORG_MIRROR is protected against command injection'
NVM_IOJS_ORG_MIRROR='`do something bad`'
! nvm_get_mirror iojs std || die 'NVM_IOJS_ORG_MIRROR errors with command injection attempt'
[ "$(nvm_get_mirror iojs std)" = "" ] || die 'NVM_IOJS_ORG_MIRROR is protected against command injection'