mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-10-24 23:33:43 +08:00
10a277ec47
3c480159 correctly made this validator actually enforce,
instead of the no-op `awk '{ $0 ~ "..." }'` it had been,
but its character class had never been audited against real mirror URLs:
it has no `:`,
so enabling enforcement silently rejected every mirror URL bearing a port.
$ NVM_NODEJS_ORG_MIRROR=https://mirror.internal:8443/dist nvm_ls_remote
$NVM_NODEJS_ORG_MIRROR and $NVM_IOJS_ORG_MIRROR may only contain a URL
No request is made at all,
so an internal mirror on a non-default port has been unusable since v0.40.5.
Allow RFC 3986 `unreserved` plus the authority and path punctuation
a mirror URL legitimately needs:
`:` for a port,
`@` for userinfo,
`[`/`]` for an IPv6 literal host,
and `%` for percent-encoding.
`sub-delims` and the query/fragment delimiters stay rejected:
nvm appends a path to this value,
so a query string could never have worked,
and several of those characters are shell metacharacters.