Check that the repo ID hasn't changed to prevent repo-jacking

Author: kevinbackhouse

src/Controller/ApiController.php

@@ -556,8 +556,15 @@ protected function findGitHubPackagesByRepository(string $path, string $remoteId
         }
 
         foreach ($packages as $package) {
-            if ($remoteId && !$package->getRemoteId()) {
-                $package->setRemoteId($remoteId);
+            if ($remoteId) {
+                $actualRemoteId = $package->getRemoteId();
+                if ($actualRemoteId) {
+                    if ($actualRemoteId !== $remoteId) {
+                        throw new BadRequestHttpException('The remoteId of the repo URL '.$path.' has changed from '.$remoteId.' to '.$actualRemoteId);
+                    }
+                } else {
+                    $package->setRemoteId($remoteId);
+                }
             }
         }