[gnome-software] Prevent potential abuse of an app list in the plugin-loader

[Richard Hughes <rhughes src gnome org>]

commit 8955657a53fe2f70dfe7069edee35d7439210a2b
Author: Joaquim Rocha <jrocha endlessm com>
Date:   Fri Mar 31 21:06:37 2017 +0200

    Prevent potential abuse of an app list in the plugin-loader
    
    The list of apps that was looped over for calling the refine in each app
    was also being passed to the refine functions. This could lead to
    problems if the function affected the list (removed or added apps).
    
    This patch fixes that issue by using a copy of the list in the loop.

 lib/gs-plugin-loader.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/lib/gs-plugin-loader.c b/lib/gs-plugin-loader.c
index 39ff78f..600e2f7 100644
--- a/lib/gs-plugin-loader.c
+++ b/lib/gs-plugin-loader.c
@@ -767,6 +767,7 @@ gs_plugin_loader_run_refine_internal (GsPluginLoaderJob *job,
        for (i = 0; i < priv->plugins->len; i++) {
                g_autoptr(AsProfileTask) ptask = NULL;
                GsPlugin *plugin = g_ptr_array_index (priv->plugins, i);
+               g_autoptr(GsAppList) app_list = NULL;
 
                /* run the batched plugin symbol then the per-app plugin */
                job->function_name = "gs_plugin_refine";
@@ -774,8 +775,14 @@ gs_plugin_loader_run_refine_internal (GsPluginLoaderJob *job,
                                                  cancellable, error)) {
                        return FALSE;
                }
-               for (j = 0; j < gs_app_list_length (list); j++) {
-                       app = gs_app_list_index (list, j);
+
+               /* use a copy of the list for the loop because a function called
+                * on the plugin may affect the list which can lead to problems
+                * (e.g. inserting an app in the list on every call results in
+                * an infinite loop) */
+               app_list = gs_app_list_copy (list);
+               for (j = 0; j < gs_app_list_length (app_list); j++) {
+                       app = gs_app_list_index (app_list, j);
                        if (!gs_app_has_quirk (app, AS_APP_QUIRK_MATCH_ANY_PREFIX)) {
                                job->function_name = "gs_plugin_refine_app";
                        } else {