eeymoo/nvm
1
0
Fork 0
mirror of https://github.com/nvm-sh/nvm.git synced 2026-09-24 00:00:23 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68

Browse Source 
`~` is a member of RFC 7235 §2.1 `token68`,
and thus of RFC 6750 §2.1 `b64token`,
but the allowlist stripped it,
silently corrupting any opaque Bearer credential containing it:

    Bearer mF_9.B5f-4.1JqM~+/=  ->  Bearer mF_9.B5f-4.1JqM+/=

`Basic` credentials were never affected,
since RFC 4648 §4 base64 cannot emit `~`;
`;` stays stripped, as it belongs to no auth-scheme production.

Cover the charset in the unit test,
and assert the credential reaches the downloader intact via the existing fake-`wget` harness,
which needs no container.
This commit is contained in:
Andres Mejia Sanchez
2026-09-02 19:36:04 -07:00
committed by Jordan Harband
parent 6798d1dbc9
commit dd0f702fb1
3 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/fast/Unit tests/nvm_download wget Authorization header
+6
View File
@@ -39,5 +39,11 @@ NVM_AUTH_HEADER='Bearer test-token' nvm_download "https://nodejs.org/dist/x" -o
grep -Fxqe '--header' "$ARGV_LOG" || die "wget did not receive --header; got: $(cat "$ARGV_LOG")"
grep -Fxq 'Authorization: Bearer test-token' "$ARGV_LOG" || die "wget did not receive a well-formed Authorization header; got: $(cat "$ARGV_LOG")"
# given a credential using every character RFC 7235 token68 permits, including '~'
# when nvm_download uses the wget path
NVM_AUTH_HEADER='Bearer mF_9.B5f-4.1JqM~+/=' nvm_download "https://nodejs.org/dist/x" -o - || die 'nvm_download (wget) returned nonzero for a token68 credential'
# then it reaches wget byte-for-byte, with no character silently dropped
grep -Fxq 'Authorization: Bearer mF_9.B5f-4.1JqM~+/=' "$ARGV_LOG" || die "wget did not receive the token68 credential intact; got: $(cat "$ARGV_LOG")"
cleanup
echo "nvm_download wget Authorization header: passed"