Skip to content

Commit 083b735

Browse files
SeldaekSeldaek
authored
Merge pull request from GHSA-h5h8-pc6h-jvvx
* Fix external process calls to avoid user input being able to pass extra parameters * Tweak some fixes
1 parent 4dc293b commit 083b735

16 files changed

+48
-48
lines changed

‎src/Composer/Downloader/FossilDownloader.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,15 @@ public function doDownload(PackageInterface $package, $path, $url)
3232
$ref = ProcessExecutor::escape($package->getSourceReference());
3333
$repoFile = $path . '.fossil';
3434
$this->io->writeError("Cloning ".$package->getSourceReference());
35-
$command = sprintf('fossil clone %s %s', $url, ProcessExecutor::escape($repoFile));
35+
$command = sprintf('fossil clone -- %s %s', $url, ProcessExecutor::escape($repoFile));
3636
if (0 !== $this->process->execute($command, $ignoredOutput)) {
3737
throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
3838
}
39-
$command = sprintf('fossil open %s --nested', ProcessExecutor::escape($repoFile));
39+
$command = sprintf('fossil open --nested -- %s', ProcessExecutor::escape($repoFile));
4040
if (0 !== $this->process->execute($command, $ignoredOutput, realpath($path))) {
4141
throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
4242
}
43-
$command = sprintf('fossil update %s', $ref);
43+
$command = sprintf('fossil update -- %s', $ref);
4444
if (0 !== $this->process->execute($command, $ignoredOutput, realpath($path))) {
4545
throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
4646
}

‎src/Composer/Downloader/GitDownloader.php

+5-5
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ public function doDownload(PackageInterface $package, $path, $url)
5151
$gitVersion = GitUtil::getVersion($this->process);
5252
$msg = "Cloning ".$this->getShortHash($ref);
5353

54-
$command = 'git clone --no-checkout %url% %path% && cd '.$flag.'%path% && git remote add composer %url% && git fetch composer && git remote set-url origin %sanitizedUrl% && git remote set-url composer %sanitizedUrl%';
54+
$command = 'git clone --no-checkout -- %url% %path% && cd '.$flag.'%path% && git remote add composer -- %url% && git fetch composer && git remote set-url origin -- %sanitizedUrl% && git remote set-url composer -- %sanitizedUrl%';
5555
if ($gitVersion && version_compare($gitVersion, '2.3.0-rc0', '>=') && Cache::isUsable($cachePath)) {
5656
$this->io->writeError('', true, IOInterface::DEBUG);
5757
$this->io->writeError(sprintf(' Cloning to cache at %s', ProcessExecutor::escape($cachePath)), true, IOInterface::DEBUG);
@@ -63,7 +63,7 @@ public function doDownload(PackageInterface $package, $path, $url)
6363
$command =
6464
'git clone --no-checkout %cachePath% %path% --dissociate --reference %cachePath% '
6565
. '&& cd '.$flag.'%path% '
66-
. '&& git remote set-url origin %sanitizedUrl% && git remote add composer %sanitizedUrl%';
66+
. '&& git remote set-url origin -- %sanitizedUrl% && git remote add composer -- %sanitizedUrl%';
6767
$msg = "Cloning ".$this->getShortHash($ref).' from cache';
6868
}
6969
} catch (\RuntimeException $e) {
@@ -125,7 +125,7 @@ public function doUpdate(PackageInterface $initial, PackageInterface $target, $p
125125

126126
$ref = $target->getSourceReference();
127127
$this->io->writeError(" Checking out ".$this->getShortHash($ref));
128-
$command = '(git remote set-url composer %s && git rev-parse --quiet --verify %s || (git fetch composer && git fetch --tags composer)) && git remote set-url composer %s';
128+
$command = '(git remote set-url composer -- %s && git rev-parse --quiet --verify %s || (git fetch composer && git fetch --tags composer)) && git remote set-url composer -- %s';
129129

130130
$commandCallable = function ($url) use ($command, $ref) {
131131
return sprintf(
@@ -411,7 +411,7 @@ protected function updateToCommit($path, $reference, $branch, $date)
411411

412412
protected function updateOriginUrl($path, $url)
413413
{
414-
$this->process->execute(sprintf('git remote set-url origin %s', ProcessExecutor::escape($url)), $output, $path);
414+
$this->process->execute(sprintf('git remote set-url origin -- %s', ProcessExecutor::escape($url)), $output, $path);
415415
$this->setPushUrl($path, $url);
416416
}
417417

@@ -424,7 +424,7 @@ protected function setPushUrl($path, $url)
424424
if (!in_array('ssh', $protocols, true)) {
425425
$pushUrl = 'https://' . $match[1] . '/'.$match[2].'/'.$match[3].'.git';
426426
}
427-
$cmd = sprintf('git remote set-url --push origin %s', ProcessExecutor::escape($pushUrl));
427+
$cmd = sprintf('git remote set-url --push origin -- %s', ProcessExecutor::escape($pushUrl));
428428
$this->process->execute($cmd, $ignoredOutput, $path);
429429
}
430430
}

‎src/Composer/Downloader/GzipDownloader.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ protected function extract($file, $path)
4242

4343
// Try to use gunzip on *nix
4444
if (!Platform::isWindows()) {
45-
$command = 'gzip -cd ' . ProcessExecutor::escape($file) . ' > ' . ProcessExecutor::escape($targetFilepath);
45+
$command = 'gzip -cd -- ' . ProcessExecutor::escape($file) . ' > ' . ProcessExecutor::escape($targetFilepath);
4646

4747
if (0 === $this->process->execute($command, $ignoredOutput)) {
4848
return;

‎src/Composer/Downloader/HgDownloader.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,13 @@ public function doDownload(PackageInterface $package, $path, $url)
2929
$hgUtils = new HgUtils($this->io, $this->config, $this->process);
3030

3131
$cloneCommand = function ($url) use ($path) {
32-
return sprintf('hg clone %s %s', ProcessExecutor::escape($url), ProcessExecutor::escape($path));
32+
return sprintf('hg clone -- %s %s', ProcessExecutor::escape($url), ProcessExecutor::escape($path));
3333
};
3434

3535
$hgUtils->runCommand($cloneCommand, $url, $path);
3636

3737
$ref = ProcessExecutor::escape($package->getSourceReference());
38-
$command = sprintf('hg up %s', $ref);
38+
$command = sprintf('hg up -- %s', $ref);
3939
if (0 !== $this->process->execute($command, $ignoredOutput, realpath($path))) {
4040
throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
4141
}
@@ -56,7 +56,7 @@ public function doUpdate(PackageInterface $initial, PackageInterface $target, $p
5656
}
5757

5858
$command = function ($url) use ($ref) {
59-
return sprintf('hg pull %s && hg up %s', ProcessExecutor::escape($url), ProcessExecutor::escape($ref));
59+
return sprintf('hg pull -- %s && hg up -- %s', ProcessExecutor::escape($url), ProcessExecutor::escape($ref));
6060
};
6161

6262
$hgUtils->runCommand($command, $url, $path);

‎src/Composer/Downloader/RarDownloader.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ protected function extract($file, $path)
4545

4646
// Try to use unrar on *nix
4747
if (!Platform::isWindows()) {
48-
$command = 'unrar x ' . ProcessExecutor::escape($file) . ' ' . ProcessExecutor::escape($path) . ' >/dev/null && chmod -R u+w ' . ProcessExecutor::escape($path);
48+
$command = 'unrar x -- ' . ProcessExecutor::escape($file) . ' ' . ProcessExecutor::escape($path) . ' >/dev/null && chmod -R u+w ' . ProcessExecutor::escape($path);
4949

5050
if (0 === $this->process->execute($command, $ignoredOutput)) {
5151
return;

‎src/Composer/Downloader/SvnDownloader.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ protected function getCommitLogs($fromReference, $toReference, $path)
172172
{
173173
if (preg_match('{.*@(\d+)$}', $fromReference) && preg_match('{.*@(\d+)$}', $toReference)) {
174174
// retrieve the svn base url from the checkout folder
175-
$command = sprintf('svn info --non-interactive --xml %s', ProcessExecutor::escape($path));
175+
$command = sprintf('svn info --non-interactive --xml -- %s', ProcessExecutor::escape($path));
176176
if (0 !== $this->process->execute($command, $output, $path)) {
177177
throw new \RuntimeException(
178178
'Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput()

‎src/Composer/Repository/Vcs/FossilDriver.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -95,13 +95,13 @@ protected function updateLocalRepo()
9595

9696
$fs->ensureDirectoryExists($this->checkoutDir);
9797

98-
if (0 !== $this->process->execute(sprintf('fossil clone %s %s', ProcessExecutor::escape($this->url), ProcessExecutor::escape($this->repoFile)), $output)) {
98+
if (0 !== $this->process->execute(sprintf('fossil clone -- %s %s', ProcessExecutor::escape($this->url), ProcessExecutor::escape($this->repoFile)), $output)) {
9999
$output = $this->process->getErrorOutput();
100100

101101
throw new \RuntimeException('Failed to clone '.$this->url.' to repository ' . $this->repoFile . "\n\n" .$output);
102102
}
103103

104-
if (0 !== $this->process->execute(sprintf('fossil open %s --nested', ProcessExecutor::escape($this->repoFile)), $output, $this->checkoutDir)) {
104+
if (0 !== $this->process->execute(sprintf('fossil open --nested -- %s', ProcessExecutor::escape($this->repoFile)), $output, $this->checkoutDir)) {
105105
$output = $this->process->getErrorOutput();
106106

107107
throw new \RuntimeException('Failed to open repository '.$this->repoFile.' in ' . $this->checkoutDir . "\n\n" .$output);
@@ -150,7 +150,7 @@ public function getDist($identifier)
150150
*/
151151
public function getFileContent($file, $identifier)
152152
{
153-
$command = sprintf('fossil cat -r %s %s', ProcessExecutor::escape($identifier), ProcessExecutor::escape($file));
153+
$command = sprintf('fossil cat -r %s -- %s', ProcessExecutor::escape($identifier), ProcessExecutor::escape($file));
154154
$this->process->execute($command, $content, $this->checkoutDir);
155155

156156
if (!trim($content)) {

‎src/Composer/Repository/Vcs/GitDriver.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ public static function supports(IOInterface $io, Config $config, $url, $deep = f
227227

228228
try {
229229
$gitUtil->runCommand(function ($url) {
230-
return 'git ls-remote --heads ' . ProcessExecutor::escape($url);
230+
return 'git ls-remote --heads -- ' . ProcessExecutor::escape($url);
231231
}, $url, sys_get_temp_dir());
232232
} catch (\RuntimeException $e) {
233233
return false;

‎src/Composer/Repository/Vcs/HgDriver.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public function initialize()
6868

6969
$repoDir = $this->repoDir;
7070
$command = function ($url) use ($repoDir) {
71-
return sprintf('hg clone --noupdate %s %s', ProcessExecutor::escape($url), ProcessExecutor::escape($repoDir));
71+
return sprintf('hg clone --noupdate -- %s %s', ProcessExecutor::escape($url), ProcessExecutor::escape($repoDir));
7272
};
7373

7474
$hgUtils->runCommand($command, $this->url, null);
@@ -229,7 +229,7 @@ public static function supports(IOInterface $io, Config $config, $url, $deep = f
229229
}
230230

231231
$processExecutor = new ProcessExecutor($io);
232-
$exit = $processExecutor->execute(sprintf('hg identify %s', ProcessExecutor::escape($url)), $ignored);
232+
$exit = $processExecutor->execute(sprintf('hg identify -- %s', ProcessExecutor::escape($url)), $ignored);
233233

234234
return $exit === 0;
235235
}

‎src/Composer/Repository/Vcs/SvnDriver.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ public static function supports(IOInterface $io, Config $config, $url, $deep = f
310310
$processExecutor = new ProcessExecutor($io);
311311

312312
$exit = $processExecutor->execute(
313-
"svn info --non-interactive ".ProcessExecutor::escape($url),
313+
"svn info --non-interactive -- ".ProcessExecutor::escape($url),
314314
$ignoredOutput
315315
);
316316

‎src/Composer/Util/Git.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ public function syncMirror($url, $dir)
254254
$commandCallable = function ($url) {
255255
$sanitizedUrl = preg_replace('{://([^@]+?):(.+?)@}', '://', $url);
256256

257-
return sprintf('git remote set-url origin %s && git remote update --prune origin && git remote set-url origin %s', ProcessExecutor::escape($url), ProcessExecutor::escape($sanitizedUrl));
257+
return sprintf('git remote set-url origin -- %s && git remote update --prune origin && git remote set-url origin -- %s', ProcessExecutor::escape($url), ProcessExecutor::escape($sanitizedUrl));
258258
};
259259
$this->runCommand($commandCallable, $url, $dir);
260260
} catch (\Exception $e) {
@@ -270,7 +270,7 @@ public function syncMirror($url, $dir)
270270
$this->filesystem->removeDirectory($dir);
271271

272272
$commandCallable = function ($url) use ($dir) {
273-
return sprintf('git clone --mirror %s %s', ProcessExecutor::escape($url), ProcessExecutor::escape($dir));
273+
return sprintf('git clone --mirror -- %s %s', ProcessExecutor::escape($url), ProcessExecutor::escape($dir));
274274
};
275275

276276
$this->runCommand($commandCallable, $url, $dir, true);

‎src/Composer/Util/Svn.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ protected function doAuthDance()
224224
protected function getCommand($cmd, $url, $path = null)
225225
{
226226
$cmd = sprintf(
227-
'%s %s%s %s',
227+
'%s %s%s -- %s',
228228
$cmd,
229229
'--non-interactive ',
230230
$this->getCredentialString(),

‎tests/Composer/Test/Downloader/FossilDownloaderTest.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -70,19 +70,19 @@ public function testDownload()
7070
->will($this->returnValue(array('http://fossil.kd2.org/kd2fw/')));
7171
$processExecutor = $this->getMockBuilder('Composer\Util\ProcessExecutor')->getMock();
7272

73-
$expectedFossilCommand = $this->getCmd('fossil clone \'http://fossil.kd2.org/kd2fw/\' \'repo.fossil\'');
73+
$expectedFossilCommand = $this->getCmd('fossil clone -- \'http://fossil.kd2.org/kd2fw/\' \'repo.fossil\'');
7474
$processExecutor->expects($this->at(0))
7575
->method('execute')
7676
->with($this->equalTo($expectedFossilCommand))
7777
->will($this->returnValue(0));
7878

79-
$expectedFossilCommand = $this->getCmd('fossil open \'repo.fossil\' --nested');
79+
$expectedFossilCommand = $this->getCmd('fossil open --nested -- \'repo.fossil\'');
8080
$processExecutor->expects($this->at(1))
8181
->method('execute')
8282
->with($this->equalTo($expectedFossilCommand))
8383
->will($this->returnValue(0));
8484

85-
$expectedFossilCommand = $this->getCmd('fossil update \'trunk\'');
85+
$expectedFossilCommand = $this->getCmd('fossil update -- \'trunk\'');
8686
$processExecutor->expects($this->at(2))
8787
->method('execute')
8888
->with($this->equalTo($expectedFossilCommand))

0 commit comments

Comments
 (0)