From fc57b93603d7d90b71ca8ec77b1c8a9171fdb467 Mon Sep 17 00:00:00 2001
From: Jordi Boggiano <j.boggiano@seld.be>
Date: Mon, 10 Jun 2024 14:56:13 +0200
Subject: [PATCH] Merge pull request from GHSA-v9qv-c7wm-wgmf

---
 src/Composer/Package/Version/VersionGuesser.php          | 9 +++++----
 .../Composer/Test/Package/Version/VersionGuesserTest.php | 6 +++---
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/Composer/Package/Version/VersionGuesser.php b/src/Composer/Package/Version/VersionGuesser.php
index 797a2c0ba..06c828675 100644
--- a/src/Composer/Package/Version/VersionGuesser.php
+++ b/src/Composer/Package/Version/VersionGuesser.php
@@ -176,7 +176,7 @@ class VersionGuesser
                 $featurePrettyVersion = $prettyVersion;
 
                 // try to find the best (nearest) version branch to assume this feature's version
-                $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'git rev-list %candidate%..%branch%', $path);
+                $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'git rev-list -- %candidate%..%branch%', $path, '%candidate%..%branch%');
                 $version = $result['version'];
                 $prettyVersion = $result['pretty_version'];
             }
@@ -254,7 +254,7 @@ class VersionGuesser
             $branches = array_map('strval', array_keys($driver->getBranches()));
 
             // try to find the best (nearest) version branch to assume this feature's version
-            $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'hg log -r "not ancestors(\'%candidate%\') and ancestors(\'%branch%\')" --template "{node}\\n"', $path);
+            $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'hg log -r "not ancestors(\'%candidate%\') and ancestors(\'%branch%\')" --template "{node}\\n"', $path, '"not ancestors(\'%candidate%\') and ancestors(\'%branch%\')"');
             $result['commit'] = '';
             $result['feature_version'] = $version;
             $result['feature_pretty_version'] = $version;
@@ -271,12 +271,13 @@ class VersionGuesser
      * @param string[]                 $branches
      * @param string                   $scmCmdline
      * @param string                   $path
+     * @param string                   $arg
      *
      * @phpstan-param non-empty-string $scmCmdline
      *
      * @return array{version: string|null, pretty_version: string|null}
      */
-    private function guessFeatureVersion(array $packageConfig, $version, array $branches, $scmCmdline, $path)
+    private function guessFeatureVersion(array $packageConfig, $version, array $branches, $scmCmdline, $path, $arg)
     {
         $prettyVersion = $version;
 
@@ -315,7 +316,7 @@ class VersionGuesser
                     continue;
                 }
 
-                $cmdLine = str_replace(array('%candidate%', '%branch%'), array($candidate, $branch), $scmCmdline);
+                $cmdLine = str_replace($arg, str_replace(array('%candidate%', '%branch%'), array($candidate, $branch), $arg), $scmCmdline);
                 if (0 !== $this->process->execute($cmdLine, $output, $path)) {
                     continue;
                 }
diff --git a/tests/Composer/Test/Package/Version/VersionGuesserTest.php b/tests/Composer/Test/Package/Version/VersionGuesserTest.php
index 292c78946..d8952d4b7 100644
--- a/tests/Composer/Test/Package/Version/VersionGuesserTest.php
+++ b/tests/Composer/Test/Package/Version/VersionGuesserTest.php
@@ -121,7 +121,7 @@ class VersionGuesserTest extends TestCase
                 'stdout' => "  arbitrary $commitHash Commit message\n* feature $anotherCommitHash Another message\n",
             ),
             array(
-                'cmd' => 'git rev-list arbitrary..feature',
+                'cmd' => 'git rev-list -- arbitrary..feature',
                 'stdout' => "$anotherCommitHash\n",
             ),
         ), true);
@@ -151,7 +151,7 @@ class VersionGuesserTest extends TestCase
                 'stdout' => "  latest-testing $commitHash Commit message\n* feature $anotherCommitHash Another message\n",
             ),
             array(
-                'cmd' => 'git rev-list latest-testing..feature',
+                'cmd' => 'git rev-list -- latest-testing..feature',
                 'stdout' => "$anotherCommitHash\n",
             ),
         ), true);
@@ -364,7 +364,7 @@ class VersionGuesserTest extends TestCase
                         "remotes/origin/1.5 03a15d220da53c52eddd5f32ffca64a7b3801bea Commit message\n",
             ),
             array(
-                'cmd' => 'git rev-list remotes/origin/1.5..feature-branch',
+                'cmd' => 'git rev-list -- remotes/origin/1.5..feature-branch',
                 'stdout' => "\n",
             ),
         ), true);