Reject invalid Domain Paths in make-pot

[swissspidy]

Applying some slight hardening

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of plugin translation Domain Path values.
  • Rejects absolute paths, stream paths, and parent-directory traversal values.
  • Valid paths continue to generate POT files in the expected source directory.
  • Invalid values are reported on STDERR, and the command exits with status 1.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Warning

Review limit reached

@swissspidy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5b72eca6-e15e-416d-aee2-7b706376f945

📥 Commits

Reviewing files that changed from the base of the PR and between bcf0077 and 37751d7.

📒 Files selected for processing (1)

• src/MakePotCommand.php

📝 Walkthrough

Walkthrough

The make-pot command now normalizes plugin Domain Path values and rejects traversal, absolute, and stream paths. An end-to-end scenario verifies the error output and exit status for a traversal value.

Changes

Domain Path validation

Layer / File(s)	Summary
Normalize and validate Domain Path src/MakePotCommand.php, features/makepot.feature	The command validates normalized Domain Path values before constructing the destination path. The feature scenario verifies rejection of path traversal with an error on STDERR and exit status 1.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copilot, brianhenryie

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting invalid Domain Paths in make-pot.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/domain-path

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR hardens wp i18n make-pot by validating the plugin/theme Domain Path header before using it to derive the POT output destination, and adds an acceptance test to ensure invalid paths are rejected.

Changes:

• Normalize and validate Domain Path before applying it to the computed destination path.
• Fail fast with a clear WP-CLI error when an invalid Domain Path is detected.
• Add a Behat scenario asserting .. traversal in Domain Path is refused.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/MakePotCommand.php	Adds normalization + validation for Domain Path before using it to build the POT destination path.
features/makepot.feature	Adds a Behat scenario asserting invalid Domain Path values are rejected with an error.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

features/makepot.feature (1)

329-347: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover the remaining rejection branches.

This scenario verifies traversal rejection only. Add scenarios for an absolute value such as C:/tmp/languages and a stream value such as php://filter/resource=languages. Verify the same error contract and return code for both cases.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@features/makepot.feature` around lines 329 - 347, Add scenarios in
features/makepot.feature covering Domain Path values “C:/tmp/languages” and
“php://filter/resource=languages”; for each, invoke wp i18n make-pot foo-plugin
and assert STDERR contains the corresponding “Error: Invalid Domain Path value:
…” message and the return code is 1, matching the existing traversal-rejection
scenario.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/MakePotCommand.php`:
- Around line 398-400: Update the domain-path validation condition in
MakePotCommand to detect parent traversal only when “..” is a complete path
component, not merely a substring within a directory name such as “foo..bar”.
Preserve the existing absolute-path, stream-path, and invalid-value error
handling checks.

---

Nitpick comments:
In `@features/makepot.feature`:
- Around line 329-347: Add scenarios in features/makepot.feature covering Domain
Path values “C:/tmp/languages” and “php://filter/resource=languages”; for each,
invoke wp i18n make-pot foo-plugin and assert STDERR contains the corresponding
“Error: Invalid Domain Path value: …” message and the return code is 1, matching
the existing traversal-rejection scenario.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c2396538-603d-4301-959a-98917f612c2f

📥 Commits

Reviewing files that changed from the base of the PR and between 81f6fcf and bcf0077.

📒 Files selected for processing (2)

• features/makepot.feature
• src/MakePotCommand.php