Commit da488722 authored by catch's avatar catch
Browse files

Issue #3537668 by phenaproxima: Dynamically figure out the actual path to...

Issue #3537668 by phenaproxima: Dynamically figure out the actual path to Composer's binary, and make it read-only

(cherry picked from commit e8e94812)
parent 45f78be8
Loading
Loading
Loading
Loading
Loading
+2 −0
Original line number Diff line number Diff line
@@ -14,6 +14,8 @@ services:
  Drupal\package_manager\ExecutableFinder:
    public: false
    decorates: 'PhpTuf\ComposerStager\API\Finder\Service\ExecutableFinderInterface'
    calls:
      - [setLogger, ['@logger.channel.package_manager']]
  Drupal\package_manager\TranslatableStringFactory:
    public: false
    decorates: 'PhpTuf\ComposerStager\API\Translation\Factory\TranslatableFactoryInterface'
+60 −6
Original line number Diff line number Diff line
@@ -5,8 +5,12 @@
namespace Drupal\package_manager;

use Composer\InstalledVersions;
use Drupal\Component\Serialization\Json;
use Drupal\Core\Config\ConfigFactoryInterface;
use Drupal\Core\File\FileSystemInterface;
use PhpTuf\ComposerStager\API\Finder\Service\ExecutableFinderInterface;
use Psr\Log\LoggerAwareInterface;
use Psr\Log\LoggerAwareTrait;

/**
 * An executable finder which looks for executable paths in configuration.
@@ -16,19 +20,27 @@
 *   at any time without warning. External code should not interact with this
 *   class.
 */
final class ExecutableFinder implements ExecutableFinderInterface {
final class ExecutableFinder implements ExecutableFinderInterface, LoggerAwareInterface {

  use LoggerAwareTrait;

  /**
   * The path where Composer is installed in the project, or FALSE if it's not.
   */
  private string|false|null $composerPath = NULL;
  private string|false $composerPackagePath;

  /**
   * The path of the Composer binary, or NULL if it can't be found.
   */
  private ?string $composerBinaryPath = NULL;

  public function __construct(
    private readonly ExecutableFinderInterface $decorated,
    private readonly ConfigFactoryInterface $configFactory,
    private readonly FileSystemInterface $fileSystem,
  ) {
    $this->composerPath = InstalledVersions::isInstalled('composer/composer')
      ? InstalledVersions::getInstallPath('composer/composer') . '/bin/composer'
    $this->composerPackagePath = InstalledVersions::isInstalled('composer/composer')
      ? InstalledVersions::getInstallPath('composer/composer')
      : FALSE;
  }

@@ -44,10 +56,52 @@ public function find(string $name): string {
    }

    // If we're looking for Composer, use the project's local copy if available.
    if ($name === 'composer' && $this->composerPath && file_exists($this->composerPath)) {
      return $this->composerPath;
    if ($name === 'composer') {
      $path = $this->getLocalComposerPath();

      if ($path && file_exists($path)) {
        // For extra security, try to make the file read-only rather than
        // directly executable. If that fails, it's worth warning about but is
        // not an actual problem.
        if (is_executable($path) && !$this->fileSystem->chmod($path, 0644)) {
          $this->logger?->warning('Composer was found at %path, but could not be made read-only.', [
            '%path' => $path,
          ]);
        }
        return $path;
      }
    }
    return $this->decorated->find($name);
  }

  /**
   * Tries to find the Composer binary installed in the project.
   *
   * @return string|null
   *   The path of the `composer` binary installed in the project's vendor
   *   dependencies, or NULL if it is not installed or cannot be found.
   */
  private function getLocalComposerPath(): ?string {
    // Composer is not installed in the project, so there's nothing to do.
    if ($this->composerPackagePath === FALSE) {
      return NULL;
    }

    // This is a bit expensive to compute, so statically cache it.
    if ($this->composerBinaryPath) {
      return $this->composerBinaryPath;
    }

    $composer_json = file_get_contents($this->composerPackagePath . '/composer.json');
    $composer_json = Json::decode($composer_json);

    foreach ($composer_json['bin'] ?? [] as $bin) {
      if (str_ends_with($bin, '/composer')) {
        $this->composerBinaryPath = $this->composerPackagePath . '/' . $bin;
        break;
      }
    }
    return $this->composerBinaryPath;
  }

}
+47 −10
Original line number Diff line number Diff line
@@ -4,10 +4,14 @@

namespace Drupal\Tests\package_manager\Unit;

use ColinODell\PsrTestLogger\TestLogger;
use Drupal\Component\Serialization\Json;
use Drupal\Core\File\FileSystemInterface;
use Drupal\package_manager\ExecutableFinder;
use Drupal\Tests\UnitTestCase;
use org\bovigo\vfs\vfsStream;
use PhpTuf\ComposerStager\API\Finder\Service\ExecutableFinderInterface;
use PHPUnit\Framework\Attributes\TestWith;

/**
 * @covers \Drupal\package_manager\ExecutableFinder
@@ -32,27 +36,46 @@ public function testCheckConfigurationForExecutablePath(): void {
    $decorated->find('composer')->shouldNotBeCalled();
    $decorated->find('rsync')->shouldBeCalled();

    $finder = new ExecutableFinder($decorated->reveal(), $config_factory);
    $finder = new ExecutableFinder(
      $decorated->reveal(),
      $config_factory,
      $this->prophesize(FileSystemInterface::class)->reveal(),
    );
    $this->assertSame('/path/to/composer', $finder->find('composer'));
    $finder->find('rsync');
  }

  /**
   * Tests that the executable finder tries to use a local copy of Composer.
   *
   * @param bool $chmod_result
   *   Whether the Composer binary will be successfully made read-only.
   */
  public function testComposerInstalledInProject(): void {
  #[TestWith([TRUE])]
  #[TestWith([FALSE])]
  public function testComposerInstalledInProject(bool $chmod_result): void {
    vfsStream::setup('root', NULL, [
      'composer-path' => [
        'bin' => [],
        'bin' => [
          'composer' => 'A fake Composer executable',
        ],
        'composer.json' => Json::encode([
          'bin' => ['bin/composer'],
        ]),
      ],
    ]);
    $composer_path = 'vfs://root/composer-path/bin/composer';
    touch($composer_path);
    $this->assertFileExists($composer_path);
    $composer_bin = 'vfs://root/composer-path/bin/composer';
    $this->assertTrue(chmod($composer_bin, 0755));

    $decorated = $this->prophesize(ExecutableFinderInterface::class);
    $decorated->find('composer')->willReturn('the real Composer');

    // The Composer binary is executable and should be made read-only.
    $file_system = $this->prophesize(FileSystemInterface::class);
    $file_system->chmod($composer_bin, 0644)
      ->willReturn($chmod_result)
      ->shouldBeCalled();

    $finder = new ExecutableFinder(
      $decorated->reveal(),
      $this->getConfigFactoryStub([
@@ -60,14 +83,28 @@ public function testComposerInstalledInProject(): void {
          'executables' => [],
        ],
      ]),
      $file_system->reveal(),
    );

    $logger = new TestLogger();
    $finder->setLogger($logger);

    $reflector = new \ReflectionProperty($finder, 'composerPackagePath');
    $reflector->setValue($finder, dirname($composer_bin, 2));
    $this->assertSame($composer_bin, $finder->find('composer'));

    // If the permissions change will fail, a warning should be logged.
    $predicate = function (array $record) use ($composer_bin): bool {
      return (
        $record['message'] === 'Composer was found at %path, but could not be made read-only.' &&
        $record['context']['%path'] === $composer_bin
      );
    $reflector = new \ReflectionProperty($finder, 'composerPath');
    $reflector->setValue($finder, $composer_path);
    $this->assertSame($composer_path, $finder->find('composer'));
    };
    $this->assertSame(!$chmod_result, $logger->hasRecordThatPasses($predicate));

    // If the executable disappears, or Composer isn't locally installed, the
    // decorated executable finder should be called.
    unlink($composer_path);
    unlink($composer_bin);
    $this->assertSame('the real Composer', $finder->find('composer'));

    $reflector->setValue($finder, FALSE);