???????????? Composer ?? ???? ???? ???? ???? PHP ???? ?? ??????????? ?? ???? ??? ?? ?????????? ??? ????? ???????? ?? ???????? ?? ?? ????? ????? ??? ??????? ???????? ? ?? ??? ???? ?? ?? ?? ???? PHP ???? ??? ? ??????? ?? ?? ?????? ?????? ????? ???? ???.
??? ???? ?????? ?? ?? CVE-2021-29472 ???? ?????? SonarSource ?? ?? ????? ???? ??? ? ????? ??[?] ? ?? ?? ??? ???? ???? ?? ?? ???? ?? ?? ???? ??? ???? ??????? ????? ??.
???????????? ??? ???? ?? ??????????? ???[?] ???? ???????? ?????? ? ??????? ?????????? ?????[?]: “?????????? ????? ????? ?? HgDriver/HgDownloader ? ???? ???????? ? ??????? ??????? VCS ????? ??? ??? ? ?? ?????? ?? ?? ????? ????? ?? ??? ?????????? ??????????? ???? ???.”
Composer ???????? ?????? ???? ?????? dependency ?? PHP ????? ??????[?] ? ??? ???? ???????? ????? ?? ?? ????? ?? ?????????? ??????. ?????? ?? ??????? ??? ????? ?? ?????? ?? ?????????? PHP ????? ?? Packagist ?? ??? ????[?]? ????? ?? ??? ???????? PHP ????? ???????? ?? Composer ?? ??? ??????.
??? ????? SonarSource? ??? ?????????? ?? ?? ???? ?????? URL ??? ??????? ???? ???? ???? ??????? ?????? ?????? ???? ?? ???????? ?????? ?? ?? ???? ?????? ????? ????? ?? ??? ??? ?? ???? ???. ???????? ????? ??? ?????? ?????? ?? ??? ????? ???????[?] ???? ???? ?? URL ???? ???? Mercurial ??????? ????? ?? ?? ????? alias ???? ????? ?? ????? shell ?? ?????? ????? ??????? ??????[?].
SonarSource ?????????? ???: “?? ?????????? ?? ?? ??? ????? ????????????? ??? ?? ??? ?????? ??????? metadata ?? ?? ??? ??? ? ????? ????? ???? ???? ??????? ?? ??? ?????? ???? ???? ??????? ????????????? ?? ????? ??????? ??????? ?? ??????? ??? ???? ?? ??????????? ??? ???? ?? ????? ???????? ??????? ???.”
??? ???? ?????? ?????????? ??? ?? ??? ?? ??????? ?? ?????? ???? ????? ??[?]? ?? ??? ???? ?? ??? ?? ????????? ?? ???? ??????? ??? Composer ???? ?? ??? ??? ?? ?? ???? ???? ???. ????? ???? ????? Composer ?? ? ????? ???? ????? ??.
Jordi Boggiano ??? ?? ????????????? ???? ??? Composer ?????????? ???[?]: “????? ?????? ??? ??????? ????? ??? ???? ???? composer.json ??????? ??? ????? ??? ???????[??] ? ???????? URL ??????? ???? ??? ???????? ?? ????? Composer ??? ???? ?? ?????? ?? ??????? ? ????? ?? ???? ?? ????? ?????? ?????? ????????????? ?????????? Composer? ????? ???.”
?????
[?] https://blog.sonarsource.com/php-supply-chain-attack-on-composer
[?] https://getcomposer.org/changelog/2.0.13
[?] https://blog.packagist.com/composer-command-injection-vulnerability
[?] https://en.wikipedia.org/wiki/Composer_(software)
[?] https://cwe.mitre.org/data/definitions/141.html
[?] https://www.mercurial-scm.org/doc/hgrc.5.html#alias
[?]https://github.com/composer/composer/blame/ee4d4ee3fae26b87dbfca2b9fba8146dd1f04a50/src/Composer/Repository/Vcs/HgDriver.php#L182
[?] https://github.com/composer/composer/security/advisories/GHSA-h5h8-pc6h-jvvx
[??] https://getcomposer.org/doc/01-basic-usage.md
[??] https://thehackernews.com/2021/04/a-new-php-composer-bug-could-enable.html
??????? :
???? ??????
