public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Merge pull request from GHSA-x7cr-6qr6-2hh6 

* GitDriver: filter branch names starting with a - character

* GitDriver: getFileContent prevent identifiers starting with a -

* HgDriver: prevent invalid identifiers and prevent file from running commands

* HgDriver: filter branches starting with a - character
pull/11212/head
Stephan 2022-04-13 14:54:58 +01:00 committed by Jordi Boggiano
parent d4b29e9916
commit c33aafaa04
No known key found for this signature in database
GPG Key ID: 7BBD42C429EC80BC
4 changed files with 157 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/Composer/Repository/Vcs/GitDriver.php
View File

@ -130,6 +130,10 @@ class GitDriver extends VcsDriver
*/
public function getFileContent($file, $identifier)
{
if (isset($identifier[0]) && $identifier[0] === '-') {
throw new \RuntimeException('Invalid git identifier detected. Identifier must not start with a -, given: ' . $identifier);
}
$resource = sprintf('%s:%s', ProcessExecutor::escape($identifier), ProcessExecutor::escape($file));
$this->process->execute(sprintf('git show %s', $resource), $content, $this->repoDir);
@ -183,7 +187,7 @@ class GitDriver extends VcsDriver
$this->process->execute('git branch --no-color --no-abbrev -v', $output, $this->repoDir);
foreach ($this->process->splitLines($output) as $branch) {
if ($branch && !preg_match('{^ *[^/]+/HEAD }', $branch)) {
if (preg_match('{^(?:\* )? *(\S+) *([a-f0-9]+)(?: .*)?$}', $branch, $match)) {
if (preg_match('{^(?:\* )? *(\S+) *([a-f0-9]+)(?: .*)?$}', $branch, $match) && $match[1][0] !== '-') {
$branches[$match[1]] = $match[2];
}
}

10
src/Composer/Repository/Vcs/HgDriver.php
View File

@ -122,7 +122,11 @@ class HgDriver extends VcsDriver
*/
public function getFileContent($file, $identifier)
{
$resource = sprintf('hg cat -r %s %s', ProcessExecutor::escape($identifier), ProcessExecutor::escape($file));
if (isset($identifier[0]) && $identifier[0] === '-') {
throw new \RuntimeException('Invalid hg identifier detected. Identifier must not start with a -, given: ' . $identifier);
}
$resource = sprintf('hg cat -r %s -- %s', ProcessExecutor::escape($identifier), ProcessExecutor::escape($file));
$this->process->execute($resource, $content, $this->repoDir);
if (!trim($content)) {
@ -182,14 +186,14 @@ class HgDriver extends VcsDriver
$this->process->execute('hg branches', $output, $this->repoDir);
foreach ($this->process->splitLines($output) as $branch) {
if ($branch && preg_match('(^([^\s]+)\s+\d+:([a-f0-9]+))', $branch, $match)) {
if ($branch && preg_match('(^([^\s]+)\s+\d+:([a-f0-9]+))', $branch, $match) && $match[1][0] !== '-') {
$branches[$match[1]] = $match[2];
}
}
$this->process->execute('hg bookmarks', $output, $this->repoDir);
foreach ($this->process->splitLines($output) as $branch) {
if ($branch && preg_match('(^(?:[\s*]*)([^\s]+)\s+\d+:(.*)$)', $branch, $match)) {
if ($branch && preg_match('(^(?:[\s*]*)([^\s]+)\s+\d+:(.*)$)', $branch, $match) && $match[1][0] !== '-') {
$bookmarks[$match[1]] = $match[2];
}
}

88
tests/Composer/Test/Repository/Vcs/GitDriverTest.php Normal file
View File

@ -0,0 +1,88 @@
<?php
namespace Composer\Test\Repository\Vcs;
use Composer\Config;
use Composer\Repository\Vcs\GitDriver;
use Composer\Test\Mock\ProcessExecutorMock;
use Composer\Test\TestCase;
class GitDriverTest extends TestCase
{
/** @var Config */
private $config;
/** @var string */
private $home;
public function setUp()
{
$this->home = self::getUniqueTmpDirectory();
$this->config = new Config();
$this->config->merge(array(
'config' => array(
'home' => $this->home,
),
));
}
public function testGetBranchesFilterInvalidBranchNames()
{
$process = $this->getMockBuilder('Composer\Util\ProcessExecutor')->getMock();
$process->expects($this->any())
->method('execute')
->will($this->returnValue(0));
$io = $this->getMockBuilder('Composer\IO\IOInterface')->getMock();
$driver = new GitDriver(array('url' => 'https://example.org/acme.git'), $io, $this->config, $process);
$this->setRepoDir($driver, $this->home);
// Branches starting with a - character are not valid git branches names
// Still assert that they get filtered to prevent issues later on
$stdout = <<<GIT
* main 089681446ba44d6d9004350192486f2ceb4eaa06 commit
2.2 12681446ba44d6d9004350192486f2ceb4eaa06 commit
-h 089681446ba44d6d9004350192486f2ceb4eaa06 commit
GIT;
$process->expects($this->at(0))
->method('execute')
->with('git branch --no-color --no-abbrev -v');
$process->expects($this->at(1))
->method('splitLines')
->will($this->returnValue(preg_split('{\r?\n}', trim($stdout))));
$branches = $driver->getBranches();
$this->assertSame(array(
'main' => '089681446ba44d6d9004350192486f2ceb4eaa06',
'2.2' => '12681446ba44d6d9004350192486f2ceb4eaa06',
), $branches);
}
public function testFileGetContentInvalidIdentifier()
{
$this->setExpectedException('\RuntimeException');
$process = $this->getMockBuilder('Composer\Util\ProcessExecutor')->getMock();
$process->expects($this->any())
->method('execute')
->will($this->returnValue(0));
$io = $this->getMockBuilder('Composer\IO\IOInterface')->getMock();
$driver = new GitDriver(array('url' => 'https://example.org/acme.git'), $io, $this->config, $process);
$this->assertNull($driver->getFileContent('file.txt', 'h'));
$driver->getFileContent('file.txt', '-h');
}
/**
* @param GitDriver $driver
* @param string $path
*/
private function setRepoDir($driver, $path)
{
$reflectionClass = new \ReflectionClass($driver);
$reflectionProperty = $reflectionClass->getProperty('repoDir');
$reflectionProperty->setAccessible(true);
$reflectionProperty->setValue($driver, $path);
}
}

57
tests/Composer/Test/Repository/Vcs/HgDriverTest.php
View File

@ -13,9 +13,11 @@
namespace Composer\Test\Repository\Vcs;
use Composer\Repository\Vcs\HgDriver;
use Composer\Test\Mock\ProcessExecutorMock;
use Composer\Test\TestCase;
use Composer\Util\Filesystem;
use Composer\Config;
use Composer\Util\ProcessExecutor;
class HgDriverTest extends TestCase
{
@ -64,4 +66,59 @@ class HgDriverTest extends TestCase
array('https://user@bitbucket.org/user/repo'),
);
}
public function testGetBranchesFilterInvalidBranchNames()
{
$process = $this->getMockBuilder('Composer\Util\ProcessExecutor')->getMock();
$process->expects($this->any())
->method('execute')
->will($this->returnValue(0));
$driver = new HgDriver(array('url' => 'https://example.org/acme.git'), $this->io, $this->config, $process);
$stdout = <<<HG_BRANCHES
default 1:dbf6c8acb640
--help 1:dbf6c8acb640
HG_BRANCHES;
$stdout1 = <<<HG_BOOKMARKS
help 1:dbf6c8acb641
--help 1:dbf6c8acb641
HG_BOOKMARKS;
$process->expects($this->at(0))
->method('execute')
->with('hg branches');
$process->expects($this->at(1))
->method('splitLines')
->will($this->returnValue(preg_split('{\r?\n}', trim($stdout))));
$process->expects($this->at(2))
->method('execute')
->with('hg bookmarks');
$process->expects($this->at(3))
->method('splitLines')
->will($this->returnValue(preg_split('{\r?\n}', trim($stdout1))));
$branches = $driver->getBranches();
$this->assertSame(array(
'help' => 'dbf6c8acb641',
'default' => 'dbf6c8acb640',
), $branches);
}
public function testFileGetContentInvalidIdentifier()
{
$this->setExpectedException('\RuntimeException');
$process = $this->getMockBuilder('Composer\Util\ProcessExecutor')->getMock();
$process->expects($this->any())
->method('execute')
->will($this->returnValue(0));
$driver = new HgDriver(array('url' => 'https://example.org/acme.git'), $this->io, $this->config, $process);
$this->assertNull($driver->getFileContent('file.txt', 'h'));
$driver->getFileContent('file.txt', '-h');
}
}