Fix Pool problem message produces invalid paths

glaubinix · glaubinix · commit 2ceac19c3727 · 2026-05-04T10:45:36.000+01:00
diff --git a/src/Composer/DependencyResolver/Problem.php b/src/Composer/DependencyResolver/Problem.php
@@ -418,8 +418,11 @@ public static function getMissingPackageReason(RepositorySet $repositorySet, Req
 
             if ($pool->isFilterListRemovedPackageVersion($packageName, $constraint)) {
                 $filters = $pool->getFilterListEntryForPackageVersion($packageName, $constraint);
+                $ignorePaths = implode(' and ', array_map(static function (string $listName): string {
+                    return '"policy.' . $listName . '.ignore"';
+                }, array_keys($filters)));
 
-                return ["- Root composer.json requires $packageName".self::constraintToText($constraint) . ', ', 'found '.self::getPackageList($packages, $isVerbose, $pool, $constraint).' but these were not loaded, because they were ' . implode(', ', $filters). '. To ignore filters for this package, add the package to the "policy.' . implode('|', array_keys($filters)). '.ignore" config. To turn the feature off entirely, you can set "policy" to false.'];
+                return ["- Root composer.json requires $packageName".self::constraintToText($constraint) . ', ', 'found '.self::getPackageList($packages, $isVerbose, $pool, $constraint).' but these were not loaded, because they were ' . implode(', ', $filters). '. To ignore filters for this package, add the package to the ' . $ignorePaths . ' config. To turn the feature off entirely, you can set "policy" to false.'];
             }
 
             return ["- Root composer.json requires $packageName".self::constraintToText($constraint) . ', ', 'found '.self::getPackageList($packages, $isVerbose, $pool, $constraint).' but these were not loaded, likely because '.(self::hasMultipleNames($packages) ? 'they conflict' : 'it conflicts').' with another require.'];
diff --git a/tests/Composer/Test/Fixtures/installer/update-policy-filter-entry-multiple-lists.test b/tests/Composer/Test/Fixtures/installer/update-policy-filter-entry-multiple-lists.test
@@ -0,0 +1,62 @@
+--TEST--
+Filter list entries from multiple lists matching a direct dependency suggest one ignore path per list.
+--COMPOSER--
+{
+    "name": "acme/project",
+    "version": "1.0.0",
+    "require": {
+        "acme/library": "1.0.0"
+    },
+    "config": {
+        "policy": {
+          "test-list": true
+        }
+    },
+    "repositories": [
+        {
+            "type": "package",
+            "package": [
+                {
+                    "name": "acme/library",
+                    "version": "1.0.0",
+                    "source": { "reference": "some.branch", "type": "git", "url": "" }
+                }
+            ],
+            "filter": {
+                "malware": [
+                    {
+                        "package": "acme/library",
+                        "constraint": "*",
+                        "url": "https://example.org/malware/acme/library",
+                        "reason": "malware",
+                        "id": "ID-malware"
+                    }
+                ],
+                "test-list": [
+                    {
+                        "package": "acme/library",
+                        "constraint": "*",
+                        "url": "https://example.org/test-list/acme/library",
+                        "reason": "policy violation",
+                        "id": "ID-test"
+                    }
+                ]
+            }
+        }
+    ]
+}
+--RUN--
+update -v
+
+--EXPECT-EXIT-CODE--
+2
+
+--EXPECT-OUTPUT--
+Loading composer repositories with package information
+Updating dependencies
+Your requirements could not be resolved to an installable set of packages.
+
+  Problem 1
+    - Root composer.json requires acme/library 1.0.0 (exact version match: 1.0.0 or 1.0.0.0), found acme/library[1.0.0] but these were not loaded, because they were flagged as malware (see https://example.org/malware/acme/library) reason: malware, filtered by test-list (see https://example.org/test-list/acme/library) reason: policy violation. To ignore filters for this package, add the package to the "policy.malware.ignore" and "policy.test-list.ignore" config. To turn the feature off entirely, you can set "policy" to false.
+
+--EXPECT--
