[Pkg-javascript-devel] Bug#836744: npm: bash completion script breaks $IFS

[Paul "LeoNerd" Evans]

Package: npm
Version: 1.4.21+ds-2
Severity: important

If the `npm` bash completion is interrupted, the IFS variable in the
shell becomes corrupted so that now basically very little works,
including aliases with spaces in.

For example:

  $ alias ls
  alias ls='ls $LS_OPTIONS'

  $ ls
  [currently works]

Now cause a completion that gets interrupted, by hitting <Tab> and then
<Ctrl-C>

  $ npm install l<Tab><Ctrl-C>

At this point the alias is now broken

  $ ls
  ls: invalid argument ‘auto -h’ for ‘--color’
  Valid arguments are:
    - ‘always’, ‘yes’, ‘force’
    - ‘never’, ‘no’, ‘none’
    - ‘auto’, ‘tty’, ‘if-tty’
  Try 'ls --help' for more information.

This bug comes from the completion script trying to save and restore
changes to IFS by its own local variable of $si, rather than simply
doing

  local IFS

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages npm depends on:
ii  node-abbrev               1.0.9-1
ii  node-ansi                 0.3.0-2
ii  node-ansi-color-table     1.0.0-1
ii  node-archy                0.0.2-1
ii  node-block-stream         0.0.7-1
ii  node-fstream              0.1.24-1
ii  node-fstream-ignore       0.0.6-2
ii  node-github-url-from-git  1.4.0-1
ii  node-glob                 4.0.5-1
ii  node-graceful-fs          3.0.2-1
ii  node-gyp                  3.4.0-1
ii  node-inherits             2.0.1-3
ii  node-ini                  1.1.0-1
ii  node-lockfile             0.4.1-1
ii  node-lru-cache            2.3.1-1
ii  node-minimatch            1.0.0-1
ii  node-mkdirp               0.5.0-1
ii  node-nopt                 3.0.1-1
ii  node-npmlog               0.0.4-1
ii  node-once                 1.1.1-1
ii  node-osenv                0.1.0-1
ii  node-read                 1.0.5-1
ii  node-read-package-json    1.2.4-1
ii  node-request              2.26.1-1
ii  node-retry                0.6.0-1
ii  node-rimraf               2.2.8-1
ii  node-semver               2.1.0-2
ii  node-sha                  1.2.3-1
ii  node-slide                1.1.4-1
ii  node-tar                  1.0.3-2
ii  node-underscore           1.7.0~dfsg-1
ii  node-which                1.0.5-2
ii  nodejs                    4.3.1~dfsg-3

npm recommends no packages.

npm suggests no packages.

-- no debconf information


-- 
Paul "LeoNerd" Evans

leonerd at leonerd.org.uk      |  https://metacpan.org/author/PEVANS
http://www.leonerd.org.uk/  |  https://www.tindie.com/stores/leonerd/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-javascript-devel/attachments/20160905/1d6eead5/attachment.sig>