From 8724f55749a97fe6a6e232d1dd900a069f9b7533 Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sat, 15 Aug 2026 09:10:09 +0900 Subject: fix(composer-repository): encode the security advisory POST body as PHP does `http_build_query(['packages' => array_keys($packageConstraintMap)])` maps a single array value, so the body PHP sends is `packages%5B0%5D=a&packages%5B1%5D=b`. The port flattened the array into repeated `packages=` pairs, losing the indices, and passed `"&"` as the numeric prefix and `"="` as the argument separator, joining every pair with `=`. Build the query from a `packages` key holding the name list and hand it to `http_build_query_mixed`, which walks the nested value. Co-Authored-By: Claude Opus 5 (1M context) --- .../shirabe/src/repository/composer_repository.rs | 23 +++++++++++----------- 1 file changed, 11 insertions(+), 12 deletions(-) (limited to 'crates/shirabe/src') diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs index 6a1b16ca..fe8faf48 100644 --- a/crates/shirabe/src/repository/composer_repository.rs +++ b/crates/shirabe/src/repository/composer_repository.rs @@ -41,7 +41,7 @@ use shirabe_pcre::{CaptureKey, Preg}; use shirabe_php_shim::Catch as _; use shirabe_php_shim::{ AnyThrowable, CmpOp, InvalidArgumentException, LogicException, PHP_EOL, PhpMixed, - RuntimeException, UnexpectedValueException, extension_loaded, hash, http_build_query, + RuntimeException, UnexpectedValueException, extension_loaded, hash, http_build_query_mixed, json_decode, parse_url_all, php_regex, realpath, strtolower, strtr, urlencode, var_export, }; use shirabe_semver::CompilingMatcher; @@ -1052,18 +1052,17 @@ impl ComposerRepository { )); http_map.insert("header".to_string(), PhpMixed::List(headers)); http_map.insert("timeout".to_string(), PhpMixed::Int(10)); - let packages_list: Vec<(String, String)> = package_constraint_map - .keys() - .map(|k| ("packages".to_string(), k.clone())) - .collect(); - let body = http_build_query( - &packages_list - .iter() - .map(|(k, v)| (k.as_str(), v.as_str())) - .collect::>(), - "&", - "=", + let mut query: IndexMap = IndexMap::new(); + query.insert( + "packages".to_string(), + PhpMixed::List( + package_constraint_map + .keys() + .map(|k| PhpMixed::String(k.clone())) + .collect(), + ), ); + let body = http_build_query_mixed(&query, "", "&"); http_map.insert("content".to_string(), PhpMixed::String(body)); } -- cgit v1.3.1-4-g156e