[Fix] nvm_download: ensure all args are quoted

Fixes #3411.

Author: ljharb

nvm.sh

@@ -128,7 +128,12 @@ nvm_download() {
     if nvm_curl_use_compression; then
       CURL_COMPRESSED_FLAG="--compressed"
     fi
-    eval "curl -q --fail ${CURL_COMPRESSED_FLAG:-} ${CURL_HEADER_FLAG:-} $*"
+    local NVM_DOWNLOAD_ARGS
+    NVM_DOWNLOAD_ARGS=''
+    for arg in "$@"; do
+      NVM_DOWNLOAD_ARGS="${NVM_DOWNLOAD_ARGS} \"$arg\""
+    done
+    eval "curl -q --fail ${CURL_COMPRESSED_FLAG:-} ${CURL_HEADER_FLAG:-} ${NVM_DOWNLOAD_ARGS}"
   elif nvm_has "wget"; then
     # Emulate curl with wget
     ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \

test/fast/Unit tests/nvm_download

@@ -25,4 +25,7 @@ NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /de
 nvm_download "http://127.0.0.1/bearer" > /dev/null && die 'nvm_download with no auth header should not send the header and should fail'
 docker stop httpbin && docker rm httpbin
 
+# ensure quoted extra args remain quoted
+nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh" -o "; die quoted-command-not-quoted" || die 'command failed'
+
 cleanup

test/install_script/nvm_download

@@ -12,7 +12,7 @@ nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/install.sh" >/de
 
 # nvm_download should fail to download wrong_install.sh
 if nvm_download "https://raw.githubusercontent.com/nvm-sh/nvm/HEAD/wrong_install.sh" &>/dev/null; then
-  die "nvm_download should fail to download no existing file"
+  die "nvm_download should fail to download nonexistent file"
 fi
 
 cleanup