Repository: nvm-sh/nvm
File: nvm.sh (Shell)

Code before:
  local CURL_COMPRESSED_FLAG
  local AUTH_HEADER_FLAG

  if [ -n "$NVM_AUTH_HEADER" ]; then
    AUTH_HEADER_FLAG="--header $NVM_AUTH_HEADER"
  fi

  if nvm_has "curl"; then
    if nvm_curl_use_compression; then
      CURL_COMPRESSED_FLAG="--compressed"
    fi
    curl --fail ${CURL_COMPRESSED_FLAG:-} ${AUTH_HEADER_FLAG:-} -q "$@"
  elif nvm_has "wget"; then
    # Emulate curl with wget
    ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \
                            -e 's/--compressed //' \
                            -e 's/--fail //' \
                            -e 's/-L //' \
                            -e 's/-I /--server-response /' \
                            -e 's/-s /-q /' \
                            -e 's/-sS /-nv /' \
                            -e 's/-o /-O /' \
                            -e 's/-C - /-c /')
                            
    if [ -n "$AUTH_HEADER_FLAG" ]; then
      ARGS="$AUTH_HEADER_FLAG $ARGS"
    fi
    # shellcheck disable=SC2086
    eval wget $ARGS
  fi
}

nvm_has_system_node() {
  [ "$(nvm deactivate >/dev/null 2>&1 && command -v node)" != '' ]
}

nvm_has_system_iojs() {
  [ "$(nvm deactivate >/dev/null 2>&1 && command -v iojs)" != '' ]
}

nvm_is_version_installed() {
  if [ -z "${1-}" ]; then
    return 1
  fi
  local NVM_NODE_BINARY
  NVM_NODE_BINARY='node'
  if [ "_$(nvm_get_os)" = '_win' ]; then
    NVM_NODE_BINARY='node.exe'
  fi
  if [ -x "$(nvm_version_path "$1" 2>/dev/null)/bin/${NVM_NODE_BINARY}" ]; then
    return 0

Review comment (security):
```suggestion
    if [ -n "${AUTH_HEADER_FLAG}" ]; then
      ARGS="${AUTH_HEADER_FLAG} ${ARGS}"
```

Code after:
  if nvm_has "curl"; then
    local CURL_COMPRESSED_FLAG=""
    local CURL_HEADER_FLAG=""

    if [ -n "${NVM_AUTH_HEADER:-}" ]; then
      sanitized_header=$(nvm_sanitize_auth_header "${NVM_AUTH_HEADER}")
      CURL_HEADER_FLAG="--header \"Authorization: ${sanitized_header}\""
    fi

    if nvm_curl_use_compression; then
      CURL_COMPRESSED_FLAG="--compressed"
    fi
    eval "curl -q --fail ${CURL_COMPRESSED_FLAG:-} ${CURL_HEADER_FLAG:-} $*"
  elif nvm_has "wget"; then
    # Emulate curl with wget
    ARGS=$(nvm_echo "$@" | command sed -e 's/--progress-bar /--progress=bar /' \
                            -e 's/--compressed //' \
                            -e 's/--fail //' \
                            -e 's/-L //' \
                            -e 's/-I /--server-response /' \
                            -e 's/-s /-q /' \
                            -e 's/-sS /-nv /' \
                            -e 's/-o /-O /' \
                            -e 's/-C - /-c /')

    if [ -n "${NVM_AUTH_HEADER:-}" ]; then
      ARGS="${ARGS} --header \"${NVM_AUTH_HEADER}\""
    fi
    # shellcheck disable=SC2086
    eval wget $ARGS
  fi
}

nvm_sanitize_auth_header() {
    # Remove potentially dangerous characters
    nvm_echo "$1" | command sed 's/[^a-zA-Z0-9:;_. -]//g'
}

nvm_has_system_node() {
  [ "$(nvm deactivate >/dev/null 2>&1 && command -v node)" != '' ]
}

nvm_has_system_iojs() {
  [ "$(nvm deactivate >/dev/null 2>&1 && command -v iojs)" != '' ]
}

nvm_is_version_installed() {
  if [ -z "${1-}" ]; then
    return 1
  fi
  local NVM_NODE_BINARY