From bcf00772f88fcb73f484d27f502f415ca4826487 Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Wed, 29 Jul 2026 08:58:58 +0200
Subject: [PATCH 1/2] Reject invalid Domain Paths in make-pot

---
 features/makepot.feature | 19 +++++++++++++++++++
 src/MakePotCommand.php   | 22 +++++++++++++++-------
 2 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/features/makepot.feature b/features/makepot.feature
index 1085ed9..59d9aeb 100644
--- a/features/makepot.feature
+++ b/features/makepot.feature
@@ -326,6 +326,25 @@ Feature: Generate a POT file of a WordPress project
     And STDERR should be empty
     And the foo-plugin/languages/foo-plugin.pot file should exist
 
+  Scenario: Refuses Domain Path header with invalid path.
+    Given an empty foo-plugin directory
+    And a foo-plugin/foo-plugin.php file:
+      """
+      <?php
+      /**
+       * Plugin Name: Foo Plugin
+       * Text Domain: foo-plugin
+       * Domain Path: ../../../../../../../../tmp/custom-languages
+       */
+      """
+
+    When I try `wp i18n make-pot foo-plugin`
+    Then STDERR should contain:
+      """
+      Error: Invalid Domain Path value: ../../../../../../../../tmp/custom-languages
+      """
+    And the return code should be 1
+
   Scenario: Uses Text Domain header when no domain is set.
     Given an empty foo-plugin directory
     And a foo-plugin/foo-plugin.php file:
diff --git a/src/MakePotCommand.php b/src/MakePotCommand.php
index 87c3817..66a0590 100644
--- a/src/MakePotCommand.php
+++ b/src/MakePotCommand.php
@@ -393,13 +393,21 @@ public function handle_arguments( $args, $assoc_args ) {
 		if ( isset( $this->main_file_data['Domain Path'] ) && is_array( $this->main_file_data['Domain Path'] ) ) {
 			$domain_path_val = $this->main_file_data['Domain Path']['value'] ?? '';
 			if ( is_scalar( $domain_path_val ) && ! empty( $domain_path_val ) ) {
-				// Domain Path inside source folder.
-				$this->destination = sprintf(
-					'%s/%s/%s.pot',
-					$this->source,
-					$this->unslashit( (string) $domain_path_val ),
-					$this->slug
-				);
+				$domain_path = $this->unslashit( Path::normalize( (string) $domain_path_val ) );
+
+				if ( false !== strpos( $domain_path, '..' ) || Path::is_absolute( $domain_path ) || Path::is_stream( $domain_path ) ) {
+					WP_CLI::error( sprintf( 'Invalid Domain Path value: %s', $domain_path_val ) );
+				}
+
+				if ( ! empty( $domain_path ) ) {
+					// Domain Path inside source folder.
+					$this->destination = sprintf(
+						'%s/%s/%s.pot',
+						$this->source,
+						$domain_path,
+						$this->slug
+					);
+				}
 			}
 		}
 

From 37751d7821399c995429d76ee754c12e6a31508c Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Mon, 3 Aug 2026 10:19:35 +0200
Subject: [PATCH 2/2] Update src/MakePotCommand.php

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 src/MakePotCommand.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/MakePotCommand.php b/src/MakePotCommand.php
index 66a0590..eb9986e 100644
--- a/src/MakePotCommand.php
+++ b/src/MakePotCommand.php
@@ -395,7 +395,7 @@ public function handle_arguments( $args, $assoc_args ) {
 			if ( is_scalar( $domain_path_val ) && ! empty( $domain_path_val ) ) {
 				$domain_path = $this->unslashit( Path::normalize( (string) $domain_path_val ) );
 
-				if ( false !== strpos( $domain_path, '..' ) || Path::is_absolute( $domain_path ) || Path::is_stream( $domain_path ) ) {
+				if ( preg_match( '#(?:^|/)\.\.(?:/|$)#', $domain_path ) || Path::is_absolute( $domain_path ) || Path::is_stream( $domain_path ) ) {
 					WP_CLI::error( sprintf( 'Invalid Domain Path value: %s', $domain_path_val ) );
 				}