public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Make sure curl is only used when safe to do so, fixes #9381

pull/9385/head
Jordi Boggiano 2020-10-30 16:20:50 +01:00
parent 8f9486b20e
commit 1d7ed333c9
No known key found for this signature in database
GPG Key ID: 7BBD42C429EC80BC
1 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/Composer/Util/HttpDownloader.php
View File

@ -168,7 +168,7 @@ class HttpDownloader
$rfs = $this->rfs;
if ($this->curl && preg_match('{^https?://}i', $job['request']['url'])) {
if ($this->canUseCurl($job)) {
$resolver = function ($resolve, $reject) use (&$job) {
$job['status'] = HttpDownloader::STATUS_QUEUED;
$job['resolve'] = $resolve;
@ -406,4 +406,25 @@ class HttpDownloader
);
}
}
private function canUseCurl(array $job)
{
if (!$this->curl) {
return false;
}
if (!preg_match('{^https?://}i', $job['request']['url'])) {
return false;
}
if (
!empty($job['request']['options']['ssl']['local_cert'])
|| !empty($job['request']['options']['ssl']['local_pk'])
|| !empty($job['request']['options']['ssl']['allow_self_signed'])
) {
return false;
}
return true;
}
}