Add a more drastic method of ensuring composer version from env (#335)

src/CosyComposer.php

@@ -560,8 +560,18 @@ public function run()
         }
         // Support an alternate composer version based on env var.
         if (!empty($_ENV['ALTERNATE_COMPOSER_PATH'])) {
+            $allow_list = [
+                '/usr/local/bin/composer22',
+            ];
+            if (!in_array($_ENV['ALTERNATE_COMPOSER_PATH'], $allow_list)) {
+                throw new \InvalidArgumentException('The alternate composer path is not allowed');
+            }
             $this->log('Trying to use composer from ' . $_ENV['ALTERNATE_COMPOSER_PATH']);
-            copy($_ENV['ALTERNATE_COMPOSER_PATH'], __DIR__ . '/../../../../vendor/bin/composer');
+            if (file_exists('/usr/local/bin/composer')) {
+                rename('/usr/local/bin/composer', '/usr/local/bin/composer.bak');
+            }
+            copy($_ENV['ALTERNATE_COMPOSER_PATH'], '/usr/local/bin/composer');
+            chmod('/usr/local/bin/composer', 0755);
         }
         // Try to get the php version as well.
         $this->execCommand(['php', '--version']);
@@ -1768,6 +1778,9 @@ private function cleanUp()
         $this->chdir('/tmp');
         $this->log('Cleaning up after update check.');
         $this->execCommand(['rm', '-rf', $this->tmpDir], false, 300);
+        if (file_exists('/usr/local/bin/composer.bak')) {
+            rename('/usr/local/bin/composer.bak', '/usr/local/bin/composer');
+        }
     }
 
     /**