[Fix] nvm_download: ensure all args are quoted

Fixes #3411.
2024-08-20 22:33:38 -07:00
parent 863bd63cfa
commit 0ce8f5a52f
3 changed files with 10 additions and 2 deletions
--- a/nvm.sh
+++ b/nvm.sh
@@ -128,7 +128,12 @@ nvm_download() {
    if nvm_curl_use_compression; then
      CURL_COMPRESSED_FLAG="--compressed"
    fi
-    eval "curl -q --fail ${CURL_COMPRESSED_FLAG:-} ${CURL_HEADER_FLAG:-} $*"
+    local NVM_DOWNLOAD_ARGS
+    NVM_DOWNLOAD_ARGS=''
+    for arg in "$@"; do
+      NVM_DOWNLOAD_ARGS="${NVM_DOWNLOAD_ARGS} \"$arg\""
+    done
+    eval "curl -q --fail ${CURL_COMPRESSED_FLAG:-} ${CURL_HEADER_FLAG:-} ${NVM_DOWNLOAD_ARGS}"
  elif nvm_has "wget"; then
    # Emulate curl with wget
    ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \