Jordan Harband 072622c748 [Fix] nvm_alias, nvm_version_path: reject .. path components ...

`nvm_alias` concatenated the requested name onto `$NVM_DIR/alias` and read whatever that resolved to,
so a name with a `..` component escaped the alias dir
- under the default layout, `../../.npmrc` reaches `$HOME/.npmrc`.
`nvm_print_alias_file` echoes every non-comment line of what it opens,
and `nvm use` reports the first one in its "is not yet installed" error,
so an untrusted `.nvmrc` could disclose any file the invoking user can read.

The write side already rejected `..` in an alias name (9275c5ba);
apply the same check on the read side, and to `nvm_version_path`,
which composes a version into a path with no check of its own.

Slashes stay legal, since `lts/iron` and the `lts/*` alias file depend on them.

2026-09-21 10:01:34 +08:00

..

mocks

[Tests] update mocks

2024-10-31 14:23:36 -07:00

assert_not_ok

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

assert_ok

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

make_echo

[tests] remove double-substitution in assert_ok and assert_not_ok

2026-04-23 17:16:32 +03:00

nvm install --offline

[Tests] run every remaining test file: exec bits, fixes; add check-exec to CI

2026-07-09 22:40:07 -07:00

nvm install -b

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm install -s and -b conflict

[Fix] nvm install: fix nvm err typo to nvm_err for -s/-b conflict

2026-03-14 09:38:04 -07:00

nvm install NVM_NO_SOURCE_FALLBACK

[New] nvm install: add NVM_NO_SOURCE_FALLBACK to disable the source fallback

2026-07-24 10:54:17 -07:00

nvm install verifies the installed version

[Robustness] nvm install: reject a structurally broken installed version

2026-07-24 10:51:53 -07:00

nvm install with nonlowercase LTS name

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm ls-remote

[Fix] nvm_has_colors: also check if stdout is a terminal

2026-01-27 10:31:07 -08:00

nvm ls-remote with nounset should not fail

[Fix] avoid an unbound variable

2026-05-15 23:08:37 -07:00

nvm set_colors

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm version-remote

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_acquire_install_lock

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_add_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_alias handles comments

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias LTS-N

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_alias path traversal

[Fix] nvm_alias, nvm_version_path: reject .. path components

2026-09-21 10:01:34 +08:00

nvm_alias_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_change_path

[Fix] nvm use: do not clobber man's default search path

2026-09-08 11:01:03 -07:00

nvm_check_for_help

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_clang_version

Add nvm_clang_version to ensure clang version > 3.5

2016-11-14 12:28:41 +08:00

nvm_command_info

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_compare_checksum

[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed

2026-09-04 14:08:01 -07:00

nvm_compute_checksum

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_curl_libz_support

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_curl_use_compression

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_curl_version

[Fix] use command to bypass curl/wget shell functions and aliases

2026-07-08 13:02:41 -07:00

nvm_die_on_prefix

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_download

[Tests] reduce CI flakiness from transient Docker registry failures

2026-06-03 13:12:31 -07:00

nvm_download and curl helpers bypass shadowed curl

[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable

2026-07-08 13:03:16 -07:00

nvm_download no eval injection

[Fix] nvm_download: avoid eval so mirror-supplied version strings can't inject commands

2026-06-02 17:41:44 -07:00

nvm_download wget Authorization header

[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68

2026-09-02 19:36:04 -07:00

nvm_download_artifact

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_download_artifact error propagation

[Fix] nvm_download_artifact: fix error propagation from subshells

2026-03-14 14:30:31 -07:00

nvm_download_artifact version injection

[Fix] nvm_download_artifact: reject version strings with disallowed characters

2026-06-03 13:09:07 -07:00

nvm_ensure_default_set

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ensure_version_installed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ensure_version_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_err

[Fix] nvm_err, nvm_err_with_colors: do not fail when stderr is closed

2026-09-04 14:08:01 -07:00

nvm_extract_tarball

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_find_project_dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_find_up

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_format_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_arch

[Tests] make the fast suite pass on Alpine

2026-07-14 23:17:01 -07:00

nvm_get_arch alpine

[Fix] support arm64-musl on Alpine Linux

2026-05-23 01:35:12 +09:00

nvm_get_arch_unofficial

[Tests] make the fast suite pass on Alpine

2026-07-14 23:17:01 -07:00

nvm_get_artifact_compression

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_checksum

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_get_checksum awk injection

[Fix] nvm_get_checksum: pass the tarball name to awk as data, not program text

2026-06-03 13:11:26 -07:00

nvm_get_checksum_alg

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_checksum_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_colors

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_default_packages

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_default_packages mawk compat

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_get_download_slug

[Fix] install: use darwin-x64 for all binary on mac for node < v16

2025-11-16 14:48:10 +05:30

nvm_get_latest missing curl or wget

[Fix] nvm_download, nvm_get_latest, install: only select a downloader that exists as an executable

2026-07-08 13:03:16 -07:00

nvm_get_make_jobs

[Fix] nvm_get_make_jobs: count cores on platforms the case does not name

2026-09-10 17:08:50 -07:00

nvm_get_minor_version

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_get_mirror

[Fix] nvm_get_mirror: allow ports, userinfo, IPv6 hosts, and percent-encoding

2026-09-02 19:40:47 -07:00

nvm_has

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_colors

[Fix] nvm_has_colors: also check if stdout is a terminal

2026-01-27 10:31:07 -08:00

nvm_has_non_aliased

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_solaris_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_system_iojs

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_has_system_node

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_hash_reset

[Fix] nvm_hash_reset: only run hash -r where the shell supports it

2026-09-04 09:16:10 -07:00

nvm_install_binary_extract

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_install_binary_extract self-heals a broken version dir

[Robustness] nvm_install_binary_extract: replace a broken version dir atomically

2026-07-24 10:50:47 -07:00

nvm_install_binary_nosource

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

nvm_install_latest_npm

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_install_lock_name

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_install_no_progress_bar

[Tests] make the fast suite pass on Alpine

2026-07-14 23:17:01 -07:00

nvm_install_source SHELL override

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_iojs_version_has_solaris_binary

[Tests] fix 4 test failures

2026-03-24 12:44:21 -07:00

nvm_is_alias

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_iojs_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_merged_node_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_natural_num

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_valid_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_is_version_installed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls handles hash in pattern

[Tests] nvm_ls handles hash in pattern: fix cleanup, isolate NVM_DIR, cover the sed path

2026-07-08 23:14:23 -07:00

nvm_ls_current

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls_remote

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_ls_remote LTS aliases

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_ls_remote LTS codename traversal

[Robustness] reject unsafe LTS alias names from a mirror's index.tab

2026-07-15 13:46:52 -07:00

nvm_ls_remote nightly

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_ls_remote_iojs

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_make_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_node_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_node_version_has_solaris_binary

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_normalize_lts

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_num_version_groups

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_offline_version

[Fix] nvm_ls_cached: include source-cached and io.js artifacts

2026-07-09 22:35:15 -07:00

nvm_print_alias_file

[Fix] nvm_alias: unset zsh's extendedglob while reading an alias file

2026-09-03 20:54:28 -07:00

nvm_print_alias_path

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_color_code

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_print_color_legend

[Tests] nvm_print_color_legend: look up the function with PATH emptied

2026-09-03 15:12:34 -07:00

nvm_print_default_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_implicit_alias errors

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_print_implicit_alias success

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_print_npm_version

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_process_nvmrc

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_rc_version errors when no version and no .nvmrc

[Fix] nvm_rc_version: clarify error when no version and no .nvmrc

2026-06-10 15:16:23 -07:00

nvm_release_install_lock

[New] nvm install: serialize concurrent installs of the same version

2026-07-24 10:55:58 -07:00

nvm_remote_version

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_remote_versions

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_remote_versions propagates iojs failure

[Fix] nvm_ls_remote_combined: propagate iojs remote listing failures

2026-03-14 09:39:20 -07:00

nvm_sanitize_auth_header

[Fix] nvm_sanitize_auth_header: allow ~, completing RFC 7235 token68

2026-09-02 19:36:04 -07:00

nvm_stdout_is_terminal

[actions] migrate Travis CI tests to GitHub Actions

2026-01-27 10:31:07 -08:00

nvm_strip_iojs_prefix

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_strip_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_supports_xz

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_tree_contains_path

[Perf] Optimize nvm_tree_contains_path with in-memory POSIX parent-walk

2026-09-03 12:24:16 +05:30

nvm_use_if_needed

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_validate_implicit_alias

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_validate_install

[Robustness] nvm install: reject a structurally broken installed version

2026-07-24 10:51:53 -07:00

nvm_version

[Tests] add try/try_err helpers; convert tests to use them

2026-03-13 15:26:07 -04:00

nvm_version_dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_version_greater

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_version_path

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

nvm_wrap_with_color_code

[Refactor] add nvm_wrap_with_color_code; allow no color code

2022-10-13 20:16:42 -07:00

nvm_write_nvmrc

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm install --save' works as expected'

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --save' works as expected'

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --save' works with a .nvmrc in the parent dir

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

Running 'nvm use --silent --save' doesn't output anything

[Tests] set $_ before sourcing nvm.sh in fast tests

2026-01-26 21:41:57 -08:00

security_wget_injection

[Fix] auth header: Add all valid base64 chars to sanitize function

2026-05-25 11:14:39 +10:00

zsh options survive nvm_list_aliases and nvm_ls

[Fix] zsh: restore nomatch and markdirs rather than clobbering them

2026-09-03 20:44:59 -07:00