Escape % chars in user input before passing to sprintf, fixes #11359

composer · Sep 28, 2023 · b4c1be6 · b4c1be6
1 parent 8beb64d
commit b4c1be6
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/Composer/DependencyResolver/Problem.php b/src/Composer/DependencyResolver/Problem.php
@@ -126,6 +126,7 @@ public static function formatDeduplicatedRules($rules, $indent, RepositorySet $r
         foreach ($rules as $rule) {
             $message = $rule->getPrettyString($repositorySet, $request, $pool, $isVerbose, $installedMap, $learnedPool);
             if (in_array($rule->getReason(), $deduplicatableRuleTypes, true) && Preg::isMatch('{^(?P<package>\S+) (?P<version>\S+) (?P<type>requires|conflicts)}', $message, $m)) {
+                $message = str_replace('%', '%%', $message);
                 $template = Preg::replace('{^\S+ \S+ }', '%s%s ', $message);
                 $messages[] = $template;
                 $templates[$template][$m[1]][$parser->normalize($m[2])] = $m[2];