Fix Composer autoloader being hijackable by script/plugin event handl…

…ers, fixes composer#11940

src/Composer/EventDispatcher/EventDispatcher.php

@@ -194,6 +194,8 @@ protected function doDispatch(Event $event)
 
         $this->pushEvent($event);
 
+        $autoloadersBefore = spl_autoload_functions();
+
         try {
             $returnMax = 0;
             foreach ($listeners as $callable) {
@@ -411,6 +413,24 @@ protected function doDispatch(Event $event)
             }
         } finally {
             $this->popEvent();
+
+            $knownIdentifiers = [];
+            foreach ($autoloadersBefore as $key => $cb) {
+                $knownIdentifiers[$this->getCallbackIdentifier($cb)] = ['key' => $key, 'callback' => $cb];
+            }
+            foreach (spl_autoload_functions() as $cb) {
+                // once we get to the first known autoloader, we can leave any appended autoloader without problems
+                if (isset($knownIdentifiers[$this->getCallbackIdentifier($cb)]) && $knownIdentifiers[$this->getCallbackIdentifier($cb)]['key'] === 0) {
+                    break;
+                }
+                if ($cb instanceof ClassLoader) {
+                    $cb->unregister();
+                    $cb->register(false);
+                } else {
+                    spl_autoload_unregister($cb);
+                    spl_autoload_register($cb);
+                }
+            }
         }
 
         return $returnMax;
@@ -638,4 +658,20 @@ private function ensureBinDirIsInPath(): void
             }
         }
     }
+
+    private function getCallbackIdentifier(callable $cb): string
+    {
+        if (is_string($cb)) {
+            return 'fn:'.$cb;
+        }
+        if (is_object($cb)) {
+            return 'obj:'.spl_object_hash($cb);
+        }
+        if (is_array($cb)) {
+            return 'array:'.(is_string($cb[0]) ? $cb[0] : get_class($cb[0]) .'#'.spl_object_hash($cb[0])).'::'.$cb[1];
+        }
+
+        // not great but also do not want to break everything here
+        return 'unsupported';
+    }
 }