github/nvm
1
0
Fork 0
mirror of https://github.com/nvm-sh/nvm.git synced 2026-10-24 23:33:43 +08:00
Code Issues Projects Releases Wiki Activity

[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding

Browse Source 
3c480159 correctly made this validator actually enforce,
instead of the no-op `awk '{ $0 ~ "..." }'` it had been,
but its character class had never been audited against real mirror URLs:
it has no `:`,
so enabling enforcement silently rejected every mirror URL bearing a port.

    $ NVM_NODEJS_ORG_MIRROR=https://mirror.internal:8443/dist nvm_ls_remote
    $NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL

No request is made at all,
so an internal mirror on a non-default port has been unusable since v0.40.5.

Allow RFC 3986 `unreserved` plus the authority and path punctuation
a mirror URL legitimately needs:
`:` for a port,
`@` for userinfo,
`[`/`]` for an IPv6 literal host,
and `%` for percent-encoding.

`sub-delims` and the query/fragment delimiters stay rejected:
nvm appends a path to this value,
so a query string could never have worked,
and several of those characters are shell metacharacters.
This commit is contained in:
Jordan Harband
2026-09-02 19:40:47 -07:00
parent dd0f702fb1
commit 10a277ec47
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
test/fast/Unit tests/nvm_get_mirror
View File

@@ -52,3 +52,26 @@ testMirrors 'not a url'
testMirrors 'ftp://wrong-scheme'
testMirrors 'http://'
testMirrors 'javascript:alert(1)'
# a query string can never work, since nvm appends a path to the mirror
testMirrors 'https://nodejs.org/dist?token=abc'
testMirrors 'https://nodejs.org/dist#frag'
testAcceptedMirrors() {
NVM_NODEJS_ORG_MIRROR="${1-}"
[ "$(nvm_get_mirror node std)" = "${1-}" ] || die "NVM_NODEJS_ORG_MIRROR should accept ${1-}"
unset NVM_NODEJS_ORG_MIRROR
NVM_IOJS_ORG_MIRROR="${1-}"
[ "$(nvm_get_mirror iojs std)" = "${1-}" ] || die "NVM_IOJS_ORG_MIRROR should accept ${1-}"
unset NVM_IOJS_ORG_MIRROR
}
# a private mirror on a non-default port is a URL, and must not be rejected
testAcceptedMirrors 'https://mirror.internal:8443/dist'
testAcceptedMirrors 'http://localhost:8080/dist'
# an IPv6 literal host, userinfo, percent-encoding, and `~` are all legal too
testAcceptedMirrors 'http://[::1]:8080/dist'
testAcceptedMirrors 'https://user:pw@nexus.corp.example.com/repository/nodejs-dist'
testAcceptedMirrors 'https://mirror.internal/a%20b/dist'
testAcceptedMirrors 'https://mirror.internal/~dist'