[gnome-software/wip/jrocha/fix_popular_overrides: 15/20] Prevent potential abuse of an app list in the plugin-loader

[Joaquim Manuel Pereira Rocha <jrocha src gnome org>]

commit c02d9d95049904a0ffd733b3d95054d31a15decb
Author: Joaquim Rocha <jrocha endlessm com>
Date:   Fri Mar 31 21:06:37 2017 +0200

    Prevent potential abuse of an app list in the plugin-loader
    
    The list of apps that was looped over for calling the refine in each app
    was also being passed to the refine functions. This could lead to
    problems if the function affected the list (removed or added apps).
    
    This patch fixes that issue by using a copy of the list in the loop.

 lib/gs-plugin-loader.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/lib/gs-plugin-loader.c b/lib/gs-plugin-loader.c
index 39ff78f..600e2f7 100644
--- a/lib/gs-plugin-loader.c
+++ b/lib/gs-plugin-loader.c
@@ -767,6 +767,7 @@ gs_plugin_loader_run_refine_internal (GsPluginLoaderJob *job,
        for (i = 0; i < priv->plugins->len; i++) {
                g_autoptr(AsProfileTask) ptask = NULL;
                GsPlugin *plugin = g_ptr_array_index (priv->plugins, i);
+               g_autoptr(GsAppList) app_list = NULL;
 
                /* run the batched plugin symbol then the per-app plugin */
                job->function_name = "gs_plugin_refine";
@@ -774,8 +775,14 @@ gs_plugin_loader_run_refine_internal (GsPluginLoaderJob *job,
                                                  cancellable, error)) {
                        return FALSE;
                }
-               for (j = 0; j < gs_app_list_length (list); j++) {
-                       app = gs_app_list_index (list, j);
+
+               /* use a copy of the list for the loop because a function called
+                * on the plugin may affect the list which can lead to problems
+                * (e.g. inserting an app in the list on every call results in
+                * an infinite loop) */
+               app_list = gs_app_list_copy (list);
+               for (j = 0; j < gs_app_list_length (app_list); j++) {
+                       app = gs_app_list_index (app_list, j);
                        if (!gs_app_has_quirk (app, AS_APP_QUIRK_MATCH_ANY_PREFIX)) {
                                job->function_name = "gs_plugin_refine_app";
                        } else {