From c2a2bd3a2573f585c902c39bd28b8c3cad10c317 Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sun, 2 Aug 2026 20:11:51 +0900 Subject: fix(repository): resolve remaining late-binding hazards from the audit Three fixes for the ComposerRepository/FilesystemRepository/PlatformRepository hazards where inner-composition delegation skipped PHP's late-bound virtual dispatch: - ComposerRepository::has_package now builds its packageMap through the late-bound getPackages() equivalent, so lazy-providers repos surface the LogicException and available-packages repos load their package list, as in PHP, instead of silently answering false from the raw array. - RepositoryInterface::get_repo_name returns anyhow::Result: PHP's getRepoName() counts through the late-bound initialize(), which is fallible in file-reading subclasses. FilesystemRepository and PackageRepository now run that initialization instead of freezing the inner array repository to an empty state (which also made a later write() truncate installed.json). Supporting changes keep the initialization chain callable from &self: JsonFile::read takes &self (indent moved into a RefCell), FilesystemRepository dev_mode became a Cell, and WritableArrayRepository dev_package_names a RefCell. - PlatformRepository::new routes constructor packages through its own add_package so the override handling and full platform initialization run as they do via PHP's parent constructor; the inner find_package/add_package delegations inside add_package (and ComposerRepository::add_package) gained the same is_initialized guard, since the constructor path would otherwise freeze the repository. Same defect class as 7db937af, 97b5211a and 3e367f78. Co-Authored-By: Claude Fable 5 --- crates/shirabe/src/repository/package_repository.rs | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) (limited to 'crates/shirabe/src/repository/package_repository.rs') diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs index 06b28451..62c8c5b3 100644 --- a/crates/shirabe/src/repository/package_repository.rs +++ b/crates/shirabe/src/repository/package_repository.rs @@ -83,13 +83,16 @@ impl PackageRepository { Ok(Ok(())) } - pub fn get_repo_name(&self) -> String { + pub fn get_repo_name(&self) -> anyhow::Result { use crate::repository::RepositoryInterface; - Preg::replace( + // PHP: parent::getRepoName() counts through the late-bound $this->initialize(), + // which resolves to PackageRepository::initialize (loading the config packages). + self.ensure_initialized()?; + Ok(Preg::replace( php_regex!(r"{^array }"), "package ", - &self.inner.get_repo_name(), - ) + &self.inner.get_repo_name()?, + )) } // In PHP the inherited ArrayRepository methods lazily call the overridden initialize() to load @@ -175,7 +178,7 @@ impl RepositoryInterface for PackageRepository { self.inner.get_providers(package_name) } - fn get_repo_name(&self) -> String { + fn get_repo_name(&self) -> anyhow::Result { PackageRepository::get_repo_name(self) } @@ -235,7 +238,7 @@ impl AdvisoryProviderInterface for PackageRepository { message: format!( "Advisory for {} could not be loaded as a full advisory from {}\n{}", package_name, - self.get_repo_name(), + self.get_repo_name()?, var_export(data, true) ), code: 0, -- cgit v1.3.1