public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Merge branch '2.0'

pull/9765/head
Jordi Boggiano 2021-03-09 23:27:32 +01:00
parent 35210d99a9 17747181d0
commit 059b5b197d
No known key found for this signature in database
GPG Key ID: 7BBD42C429EC80BC
4 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/Composer/IO/BaseIO.php
View File

@ -124,7 +124,9 @@ abstract class BaseIO implements IOInterface
}
foreach ($githubOauth as $domain => $token) {
if (!preg_match('{^[.a-z0-9]+$}', $token)) {
// allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
// plus dots which were at some point used for GH app integration tokens
if (!preg_match('{^[.A-Za-z0-9_]+$}', $token)) {
throw new \UnexpectedValueException('Your github oauth token for '.$domain.' contains invalid characters: "'.$token.'"');
}
$this->checkAndSetAuthentication($domain, $token, 'x-oauth-basic');

4
src/Composer/Repository/VcsRepository.php
View File

@ -247,7 +247,7 @@ class VcsRepository extends ArrayRepository implements ConfigurableRepositoryInt
continue;
}
$tagPackageName = isset($data['name']) ? $data['name'] : $this->packageName;
$tagPackageName = $this->packageName ?: (isset($data['name']) ? $data['name'] : '');
if ($existingPackage = $this->findPackage($tagPackageName, $data['version_normalized'])) {
if ($isVeryVerbose) {
$this->io->writeError('<warning>Skipped tag '.$tag.', it conflicts with an another tag ('.$existingPackage->getPrettyVersion().') as both resolve to '.$data['version_normalized'].' internally</warning>');
@ -386,6 +386,8 @@ class VcsRepository extends ArrayRepository implements ConfigurableRepositoryInt
protected function preProcess(VcsDriverInterface $driver, array $data, $identifier)
{
// keep the name of the main identifier for all packages
// this ensures that a package can be renamed in one place and that all old tags
// will still be installable using that new name without requiring re-tagging
$dataPackageName = isset($data['name']) ? $data['name'] : null;
$data['name'] = $this->packageName ?: $dataPackageName;

3
src/Composer/Util/ProcessExecutor.php
View File

@ -89,7 +89,8 @@ class ProcessExecutor
{
if ($this->io && $this->io->isDebug()) {
$safeCommand = preg_replace_callback('{://(?P<user>[^:/\s]+):(?P<password>[^@\s/]+)@}i', function ($m) {
if (preg_match('{^[a-f0-9]{12,}$}', $m['user'])) {
// if the username looks like a long (12char+) hex string, or a modern github token (e.g. gp1_xxx) we obfuscate that
if (preg_match('{^([a-f0-9]{12,}|g[a-z]\d_[a-zA-Z0-9_]+)$}', $m['user'])) {
return '://***:***@';
}

3
src/Composer/Util/Url.php
View File

@ -110,7 +110,8 @@ class Url
$url = preg_replace('{([&?]access_token=)[^&]+}', '$1***', $url);
$url = preg_replace_callback('{(?P<prefix>://|^)(?P<user>[^:/\s@]+):(?P<password>[^@\s/]+)@}i', function ($m) {
if (preg_match('{^[a-f0-9]{12,}$}', $m['user'])) {
// if the username looks like a long (12char+) hex string, or a modern github token (e.g. gp1_xxx) we obfuscate that
if (preg_match('{^([a-f0-9]{12,}|g[a-z]\d_[a-zA-Z0-9_]+)$}', $m['user'])) {
return $m['prefix'].'***:***@';
}