Validate version format and escape tar command arguments

[swissspidy]

Applying some slight hardening to validate version strings extracted from style.css, PHP files, and composer.json to ensure they conform to valid version characters and prevent argument injection into GNU tar commands. Also use Utils\esc_cmd to safely quote parameters passed to tar and git log commands.

Summary by CodeRabbit

• Bug Fixes
  • Improved archive creation to prevent malicious metadata from injecting commands during tarball generation.
  • Added validation for theme, plugin, and Composer version information, safely ignoring invalid values.
  • Restricted Git commit identifiers to valid seven-character hexadecimal hashes before including them in archive metadata.
• Tests
  • Added acceptance coverage confirming that crafted metadata cannot execute commands and that archives are still generated successfully.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Archive input safety

Layer / File(s)	Summary
Command and version validation src/Dist_Archive_Command.php	Tar paths are escaped before command construction. Theme, plugin, Composer, and Git-derived versions are validated before use.
Malicious metadata acceptance tests features/dist-archive.feature	Acceptance scenarios verify archive creation with malicious theme, plugin, and Composer version metadata. The theme scenario also checks that no injected proof file is created.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: version validation and escaping arguments used in the tar command.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/version-handling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 81.25000% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/Dist_Archive_Command.php	81.25%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR hardens dist-archive against command/argument injection by validating extracted version strings and safely escaping parameters passed to external commands (notably GNU tar and git).

Changes:

• Use WP_CLI\Utils\esc_cmd() when building tar commands to safely quote archive paths and directory arguments.
• Validate version strings read from style.css, plugin PHP headers, and composer.json against a strict allowed-character set, and validate appended git short-hash format.
• Add Behat acceptance tests covering malicious Version: header payloads intended to inject GNU tar arguments.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Dist_Archive_Command.php	Escapes tar/git command arguments and rejects invalid version strings to prevent injection into archive filenames.
features/dist-archive.feature	Adds scenarios asserting successful archive creation when Version: headers contain tar-flag injection attempts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/Dist_Archive_Command.php`:
- Around line 320-323: Update the version handling around $composer_obj->version
to require is_string() before trimming or casting and applying the existing
preg_match validation. Only assign $version for valid string values, safely
ignoring array or object values without triggering PHP 8 errors.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: befcf445-302f-4f72-ab75-71351e11b254

📥 Commits

Reviewing files that changed from the base of the PR and between 13528a2 and 65bc96a.

📒 Files selected for processing (2)

• features/dist-archive.feature
• src/Dist_Archive_Command.php