Validate site slug and site URL in site create and generate commands - #632
Conversation
swissspidy
added
command:site-create
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthrough
ChangesSite input validation
Estimated code review effort: 2 (Simple) | ~15 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
Pull request overview
This PR hardens the wp site create and wp site generate commands by adding stricter validation for site slugs and --site-url components to prevent unsafe or unexpected input from being accepted.
Changes:
- Added explicit validation for
--site-urlhostname and path formats insite create. - Changed slug handling in both
site createandsite generateto error out when invalid characters are present (instead of silently proceeding). - Added Behat coverage for invalid slug and invalid domain in
wp site create.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/Site_Command.php |
Adds slug validation errors for create/generate, plus domain/path validation for --site-url. |
features/site-create.feature |
Adds Behat scenarios asserting errors for invalid slug and invalid --site-url domain. |
Suppressed comments (2)
src/Site_Command.php:597
--site-urlhostnames are case-insensitive, but this code preserves case. That can produce inconsistent stored domains and can also trigger the later “different domain” warning purely due to casing. Canonicalize the host to lowercase after validating it.
if ( ! preg_match( '|^[a-zA-Z0-9.-]+$|', $custom_domain ) ) {
WP_CLI::error( 'Invalid domain format in --site-url.' );
}
src/Site_Command.php:806
wp site generatenow errors on invalid--slug, but there is no Behat scenario covering this new validation/error message. Add a test in the existing site-generate.feature to prevent regressions.
if ( ! preg_match( '|^([a-zA-Z0-9-])+$|', $base ) ) {
WP_CLI::error( 'Slug may only contain letters, numbers, and dashes.' );
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@features/site-create.feature`:
- Around line 253-262: Add a Behat scenario in site-generate.feature covering wp
site generate with an invalid --slug value, using the existing When I try step
and asserting the expected validation message on STDERR and a failure return
code. Follow the surrounding site-generate scenarios and use a slug containing
invalid special characters.
In `@src/Site_Command.php`:
- Around line 595-597: Update the custom domain validation before the existing
WP_CLI::error call to split $custom_domain into dot-separated labels and
validate each label individually. Reject empty labels, labels beginning or
ending with a hyphen, and labels containing characters outside letters, digits,
and hyphens, while preserving acceptance of valid domains before $newdomain is
passed to wpmu_create_blog().
- Around line 599-601: Update custom-path validation in the site URL handling
around $custom_path and derived $base so paths without an explicit --slug cannot
contain dots, underscores, or URL dot segments. Apply this before deriving
$base, or normalize those segments consistently, ensuring the derived slug
always satisfies the existing slug validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3a8947f2-c0e8-4994-ab80-034d9ad060a5
📒 Files selected for processing (2)
features/site-create.featuresrc/Site_Command.php
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/Site_Command.php (1)
671-674: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winReject non-DNS label slugs for subdomain installs.
The current regex only checks allowed characters. It accepts leading/trailing hyphens,
---, and values with a trailing newline; in subdomain installs these become invalid$newdomainlabels. Use one strict validator around bothsite createandsite generate: match the final label name exactly, enforce an alphanumeric first and last character in subdomain mode, and cap the length at 63 ASCII characters before constructing the domain.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/Site_Command.php` around lines 671 - 674, Update the shared slug validation used by site create and site generate at Site_Command.php:671-674 and Site_Command.php:813-816 to validate the complete final label, reject leading or trailing hyphens and newline-suffixed values, require alphanumeric first and last characters in subdomain mode, and enforce a maximum of 63 ASCII characters before constructing the domain.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/Site_Command.php`:
- Around line 608-610: Update the custom path handling in the site URL
validation and slug derivation flow: validate the raw URL path for duplicate
slashes before normalization removes them, while preserving the existing
allowed-character checks. When deriving the slug, filter only empty path
components so the valid component "0" remains for paths such as /0/ and /foo/0/.
- Line 582: Update the parsed URL validation around the $parsed_url host check
to require is_array($parsed_url) before accessing host, scheme, or path.
Preserve the existing invalid-URL error path so wp_parse_url() returning false
is handled there without offset access.
---
Outside diff comments:
In `@src/Site_Command.php`:
- Around line 671-674: Update the shared slug validation used by site create and
site generate at Site_Command.php:671-674 and Site_Command.php:813-816 to
validate the complete final label, reject leading or trailing hyphens and
newline-suffixed values, require alphanumeric first and last characters in
subdomain mode, and enforce a maximum of 63 ASCII characters before constructing
the domain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7cea0efe-26f0-4f8c-bbb6-5d60249e7a6d
📒 Files selected for processing (3)
features/site-create.featurefeatures/site-generate.featuresrc/Site_Command.php
🚧 Files skipped from review as they are similar to previous changes (1)
- features/site-create.feature
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
src/Site_Command.php (3)
677-680: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse a strict end-of-string anchor for both slug validators.
Both validators use
$, which can accept a final newline before the asserted end. If the slug comes from user input or is parsed from a path, reject final-newline variants sosite createandsite generateuse the same strict rule. Use\A[a-zA-Z0-9-]+\zor add theDmodifier insrc/Site_Command.php:677andsrc/Site_Command.php:819.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/Site_Command.php` around lines 677 - 680, The slug validators in src/Site_Command.php:677-680 and src/Site_Command.php:819-822 both use a non-strict end anchor, allowing trailing newlines. Update the preg_match patterns in both validators to use strict \A...\z anchors or the D modifier, preserving the existing allowed characters and error behavior.
582-594: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winValidate
hostandpathbefore sanitizing.
is_array()rejects non-array parse results, but arrays can still contain non-string['host']or['path']values. Extract the raw components, require both to be strings, reject malformed components before validation, then sanitize the values before storage.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/Site_Command.php` around lines 582 - 594, Update the URL handling around $parsed_url to extract the raw host and path components first, require each to be a string, and reject malformed values before sanitization or scheme validation. Then sanitize the validated string components for $custom_domain and $custom_path, preserving the default root path when path is absent.Source: Linters/SAST tools
580-588: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winReject unsupported
--site-urlcomponents.When
--site-urlis provided, onlyhostandpathare passed towpmu_create_blog(). Inputs such asuser,pass,port,query, orfragmentare accepted and discarded, so the created URL can differ from the requested URL. Reject those components before deriving$custom_domainand$custom_path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/Site_Command.php` around lines 580 - 588, Update the `has_site_url` validation in `Site_Command` to reject parsed URLs containing `user`, `pass`, `port`, `query`, or `fragment` before deriving `$custom_domain` and `$custom_path`. Preserve acceptance of URLs using only the supported host, optional path, and validated http/https scheme.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/Site_Command.php`:
- Around line 677-680: The slug validators in src/Site_Command.php:677-680 and
src/Site_Command.php:819-822 both use a non-strict end anchor, allowing trailing
newlines. Update the preg_match patterns in both validators to use strict
\A...\z anchors or the D modifier, preserving the existing allowed characters
and error behavior.
- Around line 582-594: Update the URL handling around $parsed_url to extract the
raw host and path components first, require each to be a string, and reject
malformed values before sanitization or scheme validation. Then sanitize the
validated string components for $custom_domain and $custom_path, preserving the
default root path when path is absent.
- Around line 580-588: Update the `has_site_url` validation in `Site_Command` to
reject parsed URLs containing `user`, `pass`, `port`, `query`, or `fragment`
before deriving `$custom_domain` and `$custom_path`. Preserve acceptance of URLs
using only the supported host, optional path, and validated http/https scheme.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 366b1a32-b88a-440f-82fc-fa053bf966f5
📒 Files selected for processing (2)
features/site-create.featuresrc/Site_Command.php
🚧 Files skipped from review as they are similar to previous changes (1)
- features/site-create.feature
Applying some slight hardening here
Summary by CodeRabbit
New Features
Bug Fixes