From 62bd81bf7a5c8df031c7a323e512728320f994ee Mon Sep 17 00:00:00 2001
From: Jordi Boggiano <j.boggiano@seld.be>
Date: Thu, 26 Nov 2020 14:24:16 +0100
Subject: [PATCH] Make sure the default branch alias is never used as a
 constraint by the VersionSelector

---
 src/Composer/Package/Loader/ArrayLoader.php   |  6 ++++-
 .../Package/Version/VersionSelector.php       | 10 ++++++--
 .../Package/Version/VersionSelectorTest.php   | 25 ++++++++++++++++++-
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/src/Composer/Package/Loader/ArrayLoader.php b/src/Composer/Package/Loader/ArrayLoader.php
index f73ebad20..9e136eef0 100644
--- a/src/Composer/Package/Loader/ArrayLoader.php
+++ b/src/Composer/Package/Loader/ArrayLoader.php
@@ -346,7 +346,11 @@ class ArrayLoader implements LoaderInterface
                 }
 
                 // normalize without -dev and ensure it's a numeric branch that is parseable
-                $validatedTargetBranch = $this->versionParser->normalizeBranch(substr($targetBranch, 0, -4));
+                if ($targetBranch === VersionParser::DEFAULT_BRANCH_ALIAS) {
+                    $validatedTargetBranch = VersionParser::DEFAULT_BRANCH_ALIAS;
+                } else {
+                    $validatedTargetBranch = $this->versionParser->normalizeBranch(substr($targetBranch, 0, -4));
+                }
                 if ('-dev' !== substr($validatedTargetBranch, -4)) {
                     continue;
                 }
diff --git a/src/Composer/Package/Version/VersionSelector.php b/src/Composer/Package/Version/VersionSelector.php
index 44b1d1a80..320850a1d 100644
--- a/src/Composer/Package/Version/VersionSelector.php
+++ b/src/Composer/Package/Version/VersionSelector.php
@@ -13,6 +13,7 @@
 namespace Composer\Package\Version;
 
 use Composer\Package\BasePackage;
+use Composer\Package\AliasPackage;
 use Composer\Package\PackageInterface;
 use Composer\Composer;
 use Composer\Package\Loader\ArrayLoader;
@@ -127,11 +128,16 @@ class VersionSelector
             }
         }
 
+        // if we end up with 9999999-dev as selected package, make sure we use the original version instead of the alias
+        if ($package instanceof AliasPackage && $package->getVersion() === VersionParser::DEFAULT_BRANCH_ALIAS) {
+            $package = $package->getAliasOf();
+        }
+
         return $package;
     }
 
     /**
-     * Given a concrete version, this returns a ~ constraint (when possible)
+     * Given a concrete version, this returns a ^ constraint (when possible)
      * that should be used, for example, in composer.json.
      *
      * For example:
@@ -155,7 +161,7 @@ class VersionSelector
         $loader = new ArrayLoader($this->getParser());
         $dumper = new ArrayDumper();
         $extra = $loader->getBranchAlias($dumper->dump($package));
-        if ($extra) {
+        if ($extra && $extra !== VersionParser::DEFAULT_BRANCH_ALIAS) {
             $extra = preg_replace('{^(\d+\.\d+\.\d+)(\.9999999)-dev$}', '$1.0', $extra, -1, $count);
             if ($count) {
                 $extra = str_replace('.9999999', '.0', $extra);
diff --git a/tests/Composer/Test/Package/Version/VersionSelectorTest.php b/tests/Composer/Test/Package/Version/VersionSelectorTest.php
index 66b380e7e..2aff79fcc 100644
--- a/tests/Composer/Test/Package/Version/VersionSelectorTest.php
+++ b/tests/Composer/Test/Package/Version/VersionSelectorTest.php
@@ -15,8 +15,9 @@ namespace Composer\Test\Package\Version;
 use Composer\Package\Version\VersionSelector;
 use Composer\Package\Package;
 use Composer\Package\Link;
+use Composer\Package\AliasPackage;
 use Composer\Repository\PlatformRepository;
-use Composer\Semver\VersionParser;
+use Composer\Package\Version\VersionParser;
 use Composer\Test\TestCase;
 
 class VersionSelectorTest extends TestCase
@@ -233,6 +234,27 @@ class VersionSelectorTest extends TestCase
         $this->assertSame($package2, $best, 'Latest version should be returned (1.1.0-beta)');
     }
 
+    public function testDefaultBranchAliasIsNeverReturned()
+    {
+        $packageName = 'foobar';
+
+        $package = $this->createPackage('1.1.0-beta');
+        $package2 = $this->createPackage('dev-main');
+        $package2Alias = new AliasPackage($package2, VersionParser::DEFAULT_BRANCH_ALIAS, VersionParser::DEFAULT_BRANCH_ALIAS);
+        $packages = array($package, $package2Alias);
+
+        $repositorySet = $this->createMockRepositorySet();
+        $repositorySet->expects($this->once())
+            ->method('findPackages')
+            ->with($packageName, null)
+            ->will($this->returnValue($packages));
+
+        $versionSelector = new VersionSelector($repositorySet);
+        $best = $versionSelector->findBestCandidate($packageName, null, 'dev');
+
+        $this->assertSame($package2, $best, 'Latest version should be returned (dev-main)');
+    }
+
     public function testFalseReturnedOnNoPackages()
     {
         $repositorySet = $this->createMockRepositorySet();
@@ -316,6 +338,7 @@ class VersionSelectorTest extends TestCase
             array('dev-master', true, 'dev', '^2.0@dev', '2.x-dev'),
             array('dev-master', true, 'dev', '^0.3.0@dev', '0.3.x-dev'),
             array('dev-master', true, 'dev', '^0.0.3@dev', '0.0.3.x-dev'),
+            array('dev-master', true, 'dev', 'dev-master', VersionParser::DEFAULT_BRANCH_ALIAS),
             // numeric alias
             array('3.x-dev', true, 'dev', '^3.0@dev', '3.0.x-dev'),
             array('3.x-dev', true, 'dev', '^3.0@dev', '3.0-dev'),