Merge pull request from GHSA-47f6-5gq3-vx9c

Seldaek · web-flow · commit b93fc6ca437d · 2024-06-10T14:56:42.000+02:00
diff --git a/src/Composer/Downloader/GitDownloader.php b/src/Composer/Downloader/GitDownloader.php
@@ -290,7 +290,7 @@ public function getUnpushedChanges(PackageInterface $package, $path)
                     $unpushedChanges = null;
                 }
                 foreach ($remoteBranches as $remoteBranch) {
-                    $command = sprintf('git diff --name-status %s...%s --', $remoteBranch, $branch);
+                    $command = sprintf('git diff --name-status %s --', ProcessExecutor::escape($remoteBranch.'...'.$branch));
                     if (0 !== $this->process->execute($command, $output, $path)) {
                         throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
                     }

Original file line number	Diff line number	Diff line change
`@@ -290,7 +290,7 @@ public function getUnpushedChanges(PackageInterface $package, $path)`
`290`	`290`	`$unpushedChanges = null;`
`291`	`291`	`}`
`292`	`292`	`foreach ($remoteBranches as $remoteBranch) {`
`293`		`- $command = sprintf('git diff --name-status %s...%s --', $remoteBranch, $branch);`
	`293`	`+ $command = sprintf('git diff --name-status %s --', ProcessExecutor::escape($remoteBranch.'...'.$branch));`
`294`	`294`	`if (0 !== $this->process->execute($command, $output, $path)) {`
`295`	`295`	`throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());`
`296`	`296`	`}`