Skip to content

Fix Composer autoloader being hijackable by script/plugin event handlers#11955

Merged
Seldaek merged 2 commits intocomposer:mainfrom
Seldaek:shield_autoloader
Apr 29, 2024
Merged

Fix Composer autoloader being hijackable by script/plugin event handlers#11955
Seldaek merged 2 commits intocomposer:mainfrom
Seldaek:shield_autoloader

Conversation

@Seldaek
Copy link
Copy Markdown
Member

@Seldaek Seldaek commented Apr 28, 2024

Fixes #11940

Closes #11948

@Seldaek Seldaek added the Bug label Apr 28, 2024
@Seldaek Seldaek added this to the 2.7 milestone Apr 28, 2024
@Seldaek Seldaek force-pushed the shield_autoloader branch from 73c3a9c to 8db5678 Compare April 28, 2024 14:27
@barryvdh
Copy link
Copy Markdown
Contributor

Thanks, looks good. On my case it worked with in_array without the hash, but perhapt not for all possible options.

I guess it makes sense to re-add the classloaders again at the end, but wouldn't that still make it possible to effect other scripts (eg multiple scripts running after each other)?

Smart to check once we reach the end, not sure if an old === new compare would work to avoid the rest of the checks altogether, but that might be micro optimisation.

@Seldaek
Copy link
Copy Markdown
Member Author

Seldaek commented Apr 28, 2024

Yes the normalization into strings is probably overkill, i mostly added this to be able to inspect better what was going on then just left it because it doesn't really hurt.

And re-adding at the end is needed for BC i think, otherwise a script like laravel's where you have a post-autoload-dump and a post-install-cmd both running when you do na install.. The second one would run without autoloader which probably would end bad.

@barryvdh
Copy link
Copy Markdown
Contributor

Ah yes, makes sense.

@Seldaek Seldaek merged commit bcab1c4 into composer:main Apr 29, 2024
@Seldaek Seldaek deleted the shield_autoloader branch April 29, 2024 09:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Second run of the latest composer install results in error: Call to undefined method Composer\Util\Http\ProxyManager::needsTransitionWarning()

2 participants