fix: allow double hyphens in Composer project names

Signed-off-by: anilb <epipav@gmail.com>

Author: epipav

services/apps/packages_worker/src/packagist/__tests__/listPackages.test.ts

@@ -30,6 +30,16 @@ describe('parsePackagistPackageList', () => {
     ])
   })
 
+  it('accepts up to two consecutive hyphens in the project segment only', () => {
+    // Composer's own name spec allows `-{1,2}` as a separator in the project segment
+    // but only a single separator in the vendor segment.
+    const { entries, invalid } = parsePackagistPackageList({
+      packageNames: ['vendor/my--package', 'vendor/my---package', 'my--vendor/package'],
+    })
+    expect(entries.map((e) => e.purl)).toEqual(['pkg:composer/vendor/my--package'])
+    expect(invalid).toBe(2)
+  })
+
   it('skips and counts invalid names', () => {
     const { entries, invalid } = parsePackagistPackageList({
       packageNames: [
@@ -58,6 +68,15 @@ describe('parsePackagistPackageList', () => {
     expect(invalid).toBe(1)
   })
 
+  it('rejects a long run of hyphens without catastrophic backtracking (project -{1,2} alternative)', () => {
+    const pathological = 'a' + '-'.repeat(50) + '!/name'
+    const start = Date.now()
+    const { entries, invalid } = parsePackagistPackageList({ packageNames: [pathological] })
+    expect(Date.now() - start).toBeLessThan(200)
+    expect(entries).toEqual([])
+    expect(invalid).toBe(1)
+  })
+
   it('lowercases and deduplicates names without counting duplicates as invalid', () => {
     const { entries, invalid } = parsePackagistPackageList({
       packageNames: ['Monolog/Monolog', 'monolog/monolog'],

services/apps/packages_worker/src/packagist/listPackages.ts

@@ -7,7 +7,12 @@ const PACKAGIST_LIST = 'https://packagist.org/packages/list.json'
 // Non-backtracking form: a mandatory separator per repetition (vs. an optional one)
 // removes the ambiguity that let the old `([_.-]?[a-z0-9]+)*` pattern backtrack
 // exponentially on a long run of the same character class (CodeQL js/redos).
-const COMPOSER_NAME_REGEX = /^[a-z0-9]+(?:[_.-][a-z0-9]+)*$/
+// Vendor and project segments have different rules per Composer's own name spec: the
+// vendor allows only a single separator between alnum runs, but the project segment
+// additionally allows up to two consecutive hyphens (e.g. `vendor/my--package` is a
+// valid, real Composer name) — verified against Composer's ArrayLoader name pattern.
+const COMPOSER_VENDOR_REGEX = /^[a-z0-9]+(?:[_.-][a-z0-9]+)*$/
+const COMPOSER_PROJECT_REGEX = /^[a-z0-9]+(?:(?:[_.]|-{1,2})[a-z0-9]+)*$/
 
 export interface PackagistListEntry {
   vendor: string
@@ -41,13 +46,13 @@ export function parsePackagistPackageList(json: unknown): {
     const lowercased = item.toLowerCase()
     const parts = lowercased.split('/')
 
-    // Validate: exactly one slash, each side non-empty and matches composer name pattern
+    // Validate: exactly one slash, each side non-empty and matches its composer name pattern
     if (
       parts.length !== 2 ||
       !parts[0] ||
       !parts[1] ||
-      !COMPOSER_NAME_REGEX.test(parts[0]) ||
-      !COMPOSER_NAME_REGEX.test(parts[1])
+      !COMPOSER_VENDOR_REGEX.test(parts[0]) ||
+      !COMPOSER_PROJECT_REGEX.test(parts[1])
     ) {
       invalid++
       continue