Contrib.social

Limit trusted Composer plugins to a known list, allow user to add more

Open on Drupal.org →
Created on 4 January 2023, over 1 year ago
Updated 7 February 2023, over 1 year ago

Problem/Motivation

follow-up 🐛 Hosting environment (e.g. cPanel) may add additional files (including symlinks) to the project, which breaks AU Postponed: needs info — in response to questions raised at #3323461-7: [PP-5] Hosting environment (e.g. cPanel) may add additional files (including symlinks) to the project, which breaks AU →

In that issue a site was having problems because the Composer project for Drupal was installed at the base of the hosting account. So in the directory where the project's composer.json was there were other folders such as .cpanel. Some of these folders had symlinks so our SymlinkValidator was stopping Package Manager from working. Even if these folders did not have symlinks there would still be a problem because package_manager by default works by assuming everything under project root should be staged unless a folder is explicitly excluded. If we staged a folder like .cpanel and a change was made to the system this folder after we staged it we could wipe out these changes when we applied the update.

The main reason package_manager stages the whole project directory is because unfortunately even though something is not in the install path of a Composer package does not mean it is not managed by Composer. For instance our drupal/core-composer-scaffold plugin puts index.php and other files in their places and when a core update happens these files might be updated. But if we looked for the path index.php and the other files it manages under any of the install_path's of the packages that Composer knows about they would not be present. Of course we ship with drupal/core-composer-scaffold so we could special case these files.

The problem is if we special case these files then we are implicitly declaring that no other composer plugin can act like drupal/core-composer-scaffold and manage files outside it's install_path because we would not know about the files it manages.

So by default package_manager has been including everything inside the Composer project expect things that explicitly excluded. We exclude paths we know should excluded like the Sqlite db file or the files folder, see the classes under package_manager/src/PathExcluder. Basically we did this because we determined because of how Composer plugins work there is no 100% sure way of knowing what is managed by composer. If we accidentally exclude files that are managed by composer these files will not get updated if a new version of package updates these. Since we don't know the purpose of the files we might miss it is probably best to assume they are critical

Proposed resolution

Create a package manager enforce that only know Composer plugins are allowed.

This validator should:

  1. ✅
  2. ✅
  3. ✅
  4. ✅

Remaining tasks

  1. ✅ → 📌 [Policy, no patch] Projects depending on composer plugins will have to update the additional_trusted_composer_plugins setting in package_manager.settings Active
  2. Deviated from point 3, see question in #9:

User interface changes

Instead of allowing all composer plugins by default, restricting to only explicitly trusted composer plugins.

API changes

package_manager.settings configuration now has a additional_trusted_composer_plugins setting, which accepts a list of package names.

The following composer plugins are supported by default:

  1. drupal/core-vendor-hardening
  2. drupal/core-composer-scaffold
  3. drupal/core-project-message
  4. dealerdirect/phpcodesniffer-composer-installer
  5. phpstan/extension-installer
  6. cweagans/composer-patches

(The first 3 are Drupal core's (of which the first comes with an associated excluder: VendorHardeningExcluder), the 4th and 5th are used for Drupal core development and don't interfere with php-tuf/composer-stager and the last one comes with explicit validation: ComposerPatchesValidator.)

Data model changes

None.

📌 Task
Status

Fixed

Version

2.0

Component

Package Manager

Created by

🇺🇸United States tedbow Ithaca, NY, USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024