Check that the repo ID hasn't changed to prevent repo-jacking

composer · Nov 15, 2023 · 20a7daf · 20a7daf
1 parent 9e34e90
commit 20a7daf
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/src/Controller/ApiController.php b/src/Controller/ApiController.php
@@ -556,8 +556,15 @@ protected function findGitHubPackagesByRepository(string $path, string $remoteId
  }
 
  foreach ($packages as $package) {
- if ($remoteId && !$package->getRemoteId()) {
- $package->setRemoteId($remoteId);
+ if ($remoteId) {
+ $actualRemoteId = $package->getRemoteId();
+ if ($actualRemoteId) {
+ if ($actualRemoteId !== $remoteId) {
+ throw new BadRequestHttpException('The remoteId of the repo URL '.$path.' has changed from '.$remoteId.' to '.$actualRemoteId);
+ }
+ } else {
+ $package->setRemoteId($remoteId);
+ }
  }
  }