PHP Composer漏洞可能引发供应链攻击

复制composer/src/Composer/Util/ProcessExecutor.php  use Symfony\Component\Process\Process;  // [...]  class ProcessExecutor  {      // [...]      public function execute($command,发供 &$output = null, $cwd = null)      {          if (func_num_args() > 1) {              return $this->doExecute($command, $cwd, false, $output);          }          return $this->doExecute($command, $cwd, false);      }      // [...]      private function doExecute($command, $cwd, $tty, &$output = null)      {          // [...]          if (method_exists(Symfony\Component\Process\Process, fromShellCommandline)) {              // [1]              $process = Process::fromShellCommandline($command, $cwd, null, null, static::getTimeout());          } else {              // [2]              $process = new Process($command, $cwd, null, null, static::getTimeout());          }          if (!Platform::isWindows() && $tty) {              try {                  $process->setTty(true);              } catch (RuntimeException $e) {                  // ignore TTY enabling errors              }          }          $callback = is_callable($output) ? $output : array($this, outputHandler);          $process->run($callback);  1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.32.33.34.

本文地址：http://www.bhae.cn/html/73a23299694.html