Harden router.php against path traversal and non-PHP execution

[swissspidy]

Summary by CodeRabbit

• Bug Fixes
  • Improved protection against encoded path traversal by ensuring requests remain within the document root.
  • Prevented PHP code in files with non-PHP extensions from being executed.
  • Improved handling of missing, unresolved, and outside-root files through fallback routing.
  • Added case-insensitive handling for PHP file extensions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fc3f82a5-7bad-48d0-bb08-b2fbf584c03d

📥 Commits

Reviewing files that changed from the base of the PR and between f7f2700 and 29bfe21.

📒 Files selected for processing (2)

• features/server.feature
• router.php

🚧 Files skipped from review as they are similar to previous changes (2)

• features/server.feature
• router.php

---

📝 Walkthrough

Walkthrough

The router now resolves canonical paths, restricts direct serving to the document root, falls back to WordPress for external paths, and executes only PHP files. Feature coverage verifies encoded traversal protection and static handling of non-PHP files.

Changes

Server routing security

Layer / File(s)	Summary
Canonical path containment and fallback router.php, features/server.feature	The router resolves the document root and requested file, checks containment, and routes unresolved or external requests to WordPress. Feature coverage verifies encoded traversal handling.
Resolved direct-file serving router.php, features/server.feature	Direct-file handling uses resolved paths for directory checks and PHP execution. PHP extension matching is case-insensitive. Feature coverage verifies that non-PHP files remain static.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the router security changes for path traversal and non-PHP execution.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/router

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR hardens the wp server router to reduce exposure to path traversal (including via resolved real paths) and to ensure only .php files are executed, while adding Behat coverage for these security behaviors.

Changes:

• Resolve real paths and enforce that requested targets stay within DOCUMENT_ROOT before routing/executing.
• Restrict execution to files with a .php extension (case-insensitive), returning static handling for non-PHP files.
• Add Behat scenarios validating traversal attempts don’t escape the docroot and that non-PHP extensions aren’t executed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
router.php	Adds realpath-based docroot containment checks and enforces PHP-only execution in the router.
features/server.feature	Adds Behat scenarios to cover traversal blocking and non-PHP non-execution behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@features/server.feature`:
- Around line 102-111: Remove the contradictory STDOUT assertion in the curl
scenario: retain the check that the response contains the literal PHP source and
delete the subsequent assertion requiring STDOUT not to contain FAIL_EXECUTION.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: edf407d5-96c6-4d52-afe6-1b50e9c52a91

📥 Commits

Reviewing files that changed from the base of the PR and between c80dbd7 and f7f2700.

📒 Files selected for processing (2)

• features/server.feature
• router.php

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!