composer: reorder options on command-line: put --working-dir= first

[drzraf]

Summary

This module generates suitable command lines relying on the composer binary.

Typical command-lines look like /usr/bin/php /usr/bin/composer <FOO> --no-ansi --no-interaction --working-dir <BAR> <BAZ>

Where

• FOO is the command
• BAR is the working_dir
• BAZ are the additional arguments

Considerations

1. From a syntax PoV, --working-dir is a global option, supported by all composer commands and as such can (and should) be issued at the beginning of the command-line, before the composer command itself, eg composer --working-dir=... install/require/help ...

2. On top of that, in some scenarios, putting --working-dir first is actually beneficial:

• The --working-directory is a sensitive option, it allows to execute arbitrary PHP-code in that directory. The command itself, not so much
• When it comes to either security or audit log, --working-directory= is the option one would either grep, analyze or restrict
• In the case of sudoers (but could be for ssh authorized commands, selinux, apparmor, firejail LSM or similar), having the sensitive/variable component at the beginning makes more sense and make things more easy, eg %operator IT = (foo:bar) NOPASSWD /usr/bin/composer --working-dir=restricted *
• composer only considers the first occurrence of this option (no possible override)

#3787 is related since it fall into above mentioned case n°1 and fixing both issues with the same modification is possible.

Issue Type

Feature Idea

Component Name

composer

Additional Information

This would be the command line generated by the module
/usr/bin/php /usr/bin/composer --working-dir <BAR> <FOO> --no-ansi --no-interaction <BAZ>

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• plugins/modules/packaging/language/composer.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @dmtrs
click here for bot help

[ansibullbot]

Files identified in the description:

• plugins/modules/composer.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help