Repository navigation
fix(site): validate the site name and quote values in WordPress create commands - #243
Merged
mrrobot47 merged 4 commits intoOct 12, 2026
Merged
Conversation
Validate the site name with site-command's validate_site_name() right after it is lowercased, before anything touches the shell, the file system or docker. Needs the site-command release that adds validate_site_name().
The page cache key prefixes were interpolated unquoted, and the wp core install URL, the wp config create DB name and user, and the remote DB checks used hand-written quotes (nested inside a double-quoted bash -c script for the remote DB checks), so a value containing a quote or shell syntax was not passed through as one argument. Quote each value with escapeshellarg(), nesting it for the sh -c/bash -c scripts.
… check site-command's create router validates the name as well; the guard keeps site-type-wp working next to an older site-command instead of failing with an undefined function.
The install command now carries the shell-escaped admin values, which differ from the raw values when they contain a quote, so the log masking missed them. Mask the escaped forms first, then the raw ones.
There was a problem hiding this comment.
🟡 Changes recommended
Remote database names remain vulnerable to SQL injection despite shell escaping.
2 open findings
What changed in this PR
Adds optional site-name validation and safer shell argument handling during WordPress creation.
Changes:
- Validates site names when supported by site-command.
- Quotes database, cache, and administrator values.
- Masks quoted administrator credentials in logs.
| File | Description |
|---|---|
src/WordPress.php |
Hardens site creation and database commands. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This was referenced Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Calls site-command's site-name validation on create (when available), and quotes the database, admin and cache values passed to
wp config,wp core installand the remote database checks. Values with quotes or shell characters, such as a database password or a site title with an apostrophe, now work. The logged install command masks the admin credentials in their quoted form.Needs the site-command site-name validation (EasyEngine/site-command#509, merged) for the validation itself; without it the create behaves as before.