|
| 1 | +name: bughunt-composer probe |
| 2 | +on: |
| 3 | + push: |
| 4 | + branches: ['bughunt/composer/**'] |
| 5 | +permissions: |
| 6 | + contents: read |
| 7 | +jobs: |
| 8 | + probe: |
| 9 | + name: composer ${{ matrix.composer }} / php ${{ matrix.php }} / ${{ matrix.os }} |
| 10 | + strategy: |
| 11 | + fail-fast: false |
| 12 | + matrix: |
| 13 | + include: |
| 14 | + - {os: ubuntu-latest, composer: '1.10.28', php: '7.2', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 15 | + - {os: ubuntu-latest, composer: '1.10.28', php: '7.4', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 16 | + - {os: ubuntu-latest, composer: '1.10.28', php: '8.0', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 17 | + - {os: ubuntu-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 18 | + - {os: ubuntu-latest, composer: '1.10.28', php: '8.4', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 19 | + - {os: windows-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 20 | + - {os: macos-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a} |
| 21 | + - {os: ubuntu-latest, composer: '2.2.30', php: '7.2', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2} |
| 22 | + runs-on: ${{ matrix.os }} |
| 23 | + timeout-minutes: 20 |
| 24 | + steps: |
| 25 | + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 |
| 26 | + with: |
| 27 | + php-version: ${{ matrix.php }} |
| 28 | + tools: none |
| 29 | + extensions: zip, mbstring, curl, openssl |
| 30 | + coverage: none |
| 31 | + - name: probe |
| 32 | + shell: bash |
| 33 | + env: |
| 34 | + V: ${{ matrix.composer }} |
| 35 | + SHA: ${{ matrix.sha256 }} |
| 36 | + run: | |
| 37 | + set -uo pipefail |
| 38 | + W="$RUNNER_TEMP/w"; command -v cygpath >/dev/null && W="$(cygpath -m "$RUNNER_TEMP")/w" |
| 39 | + mkdir -p "$W/srv" "$W/pkgs/tool/src" "$W/app" |
| 40 | + curl -fsSL --retry 3 -o "$W/composer.phar" "https://github.com/composer/composer/releases/download/$V/composer.phar" |
| 41 | + actual="$(php -r 'echo hash_file("sha256", $argv[1]);' "$W/composer.phar")" |
| 42 | + [ "$actual" = "$SHA" ] || { echo "sha mismatch $actual"; exit 1; } |
| 43 | + PY=python3; command -v python3 >/dev/null || PY=python |
| 44 | + cd "$W" |
| 45 | + printf '{"name":"acme/tool","version":"1.0.0","autoload":{"psr-4":{"Acme\\\\":"src/"}}}' > pkgs/tool/composer.json |
| 46 | + printf "<?php\nfunction acme_tool() { return 'vulnerable'; }\n" > pkgs/tool/src/Tool.php |
| 47 | + $PY - <<'PYEOF' |
| 48 | + import hashlib, json, zipfile |
| 49 | + z = "srv/tool-1.0.0.zip" |
| 50 | + with zipfile.ZipFile(z, "w") as f: |
| 51 | + f.writestr("acme-tool-1.0.0/composer.json", open("pkgs/tool/composer.json").read()) |
| 52 | + f.writestr("acme-tool-1.0.0/src/Tool.php", "<?php\nfunction acme_tool() { return 'patched'; }\n") |
| 53 | + sha1 = hashlib.sha1(open(z, "rb").read()).hexdigest() |
| 54 | + json.dump({"name": "app/app", "repositories": [{"type": "path", "url": "../pkgs/tool"}, {"packagist": False}], |
| 55 | + "require": {"acme/tool": "1.0.0"}, "config": {"secure-http": False}}, open("app/composer.json", "w"), indent=4) |
| 56 | + entry = {"name": "acme/tool", "version": "1.0.0", |
| 57 | + "dist": {"type": "zip", "url": "http://127.0.0.1:18765/tool-1.0.0.zip", |
| 58 | + "reference": "3769e7846b03796e6519e41c1f801f1905d22889", "shasum": sha1}, |
| 59 | + "type": "library", "autoload": {"psr-4": {"Acme\\": "src/"}}, |
| 60 | + "transport-options": {"relative": True}} |
| 61 | + lock = {"_readme": [], "content-hash": "x", "packages": [entry], "packages-dev": [], "aliases": [], |
| 62 | + "minimum-stability": "stable", "stability-flags": [], "prefer-stable": False, "prefer-lowest": False, |
| 63 | + "platform": [], "platform-dev": [], "plugin-api-version": "1.1.0"} |
| 64 | + json.dump(lock, open("app/kept.lock", "w"), indent=4) |
| 65 | + entry.pop("transport-options") |
| 66 | + json.dump(lock, open("app/stripped.lock", "w"), indent=4) |
| 67 | + PYEOF |
| 68 | + (cd srv && $PY -m http.server 18765 --bind 127.0.0.1 >/dev/null 2>&1 &) |
| 69 | + sleep 3 |
| 70 | + cd app |
| 71 | + for variant in kept stripped; do |
| 72 | + rm -rf vendor "$W/cache-$variant"; cp "$variant.lock" composer.lock |
| 73 | + COMPOSER_HOME="$W/home" COMPOSER_CACHE_DIR="$W/cache-$variant" php ../composer.phar install --no-interaction --no-progress > "../$variant.log" 2>&1 |
| 74 | + rc=$? |
| 75 | + got="$(cat vendor/acme/tool/src/Tool.php 2>/dev/null | grep -o "'[a-z]*'" || echo NOT-INSTALLED)" |
| 76 | + echo "RESULT $V php${{ matrix.php }} ${{ matrix.os }} $variant: exit=$rc installed=$got" |
| 77 | + grep -m2 -iE "ValueError|options should|exception|error" "../$variant.log" || true |
| 78 | + done |
0 commit comments