Normalize text domain string in make-json command

[swissspidy]

Applying some slight hardening

Summary by CodeRabbit

• Bug Fixes
  • Improved safety when generating JSON filenames from translation domains.
  • Domain values from headers and command-line options are now normalized to safe filenames, preventing directory traversal issues.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 43645048-942b-4ca5-b4d8-7c202948bd88

📥 Commits

Reviewing files that changed from the base of the PR and between 81f6fcf and 851f7d0.

📒 Files selected for processing (2)

• features/makejson.feature
• src/MakeJsonCommand.php

---

📝 Walkthrough

Walkthrough

The JSON generation command now removes unsafe characters from effective translation domains before creating filenames. End-to-end coverage verifies domains from PO headers and CLI arguments produce files within the destination directory.

Changes

Domain filename sanitization

Layer / File(s)	Summary
Normalize domains before JSON filename creation src/MakeJsonCommand.php, features/makejson.feature	make_json() removes characters other than letters, digits, and hyphens from the effective domain. End-to-end scenarios verify normalized filenames for PO-header and CLI-provided domains.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: normalizing the text domain string in the make-json command.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/domain-header

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR hardens the wp i18n make-json command by ensuring the text domain used in output JSON filenames is normalized to a safe character set, preventing domains sourced from PO headers or CLI args from producing unsafe/undesired paths.

Changes:

• Sanitize the effective $domain in MakeJsonCommand::make_json() by stripping non-alphanumeric / non-hyphen characters before it is used to prefix the output base filename.
• Add a Behat scenario that verifies normalization for both the X-Domain PO header and the --domain CLI argument, including asserting no file is created outside the intended destination directory.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/MakeJsonCommand.php	Normalizes/sanitizes the domain string before using it in the JSON output base filename.
features/makejson.feature	Adds acceptance coverage ensuring unsafe domains from headers/flags are normalized and do not escape the destination path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.