GH#3603: fix critical quality-debt from PR #436 review feedback by alex-solovyev · Pull Request #4338 · marcusquinn/aidevops

alex-solovyev · 2026-03-13T02:47:53Z

Summary

Fixes the command injection vulnerability in wp-helper.sh identified by Gemini Code Assist in the PR #436 review.

Root Cause

PR #436 refactored build_ssh_command → execute_wp_via_ssh to eliminate eval, but the replacement code interpolated $wp_command directly into the SSH remote command string without quoting:

# VULNERABLE (before):
ssh ... "${ssh_user}@${ssh_host}" "cd $(printf %q "$wp_path") && wp $wp_command"

If $wp_command contained shell metacharacters (;, `, $(...), &&, ||, etc.), they would be interpreted by the remote shell — a command injection vulnerability.

Fix

Quote each word of $wp_command using printf '%q ' before embedding it in the remote command string:

# SAFE (after):
quoted_wp_command=$(printf '%q ' $wp_command)
ssh ... "${ssh_user}@${ssh_host}" "cd $(printf %q "$wp_path") && wp $quoted_wp_command"

The localwp case (direct local execution via subshell) is unaffected — it uses intentional word-splitting for direct wp invocation, not a shell-interpreted string.

Verification

shellcheck -S error .agents/scripts/wp-helper.sh passes with no errors
Normal WP-CLI commands (e.g. plugin list --format=json) are unaffected: printf '%q ' quotes them safely
Malicious input (e.g. plugin list; rm -rf /) is neutralised: the semicolon becomes \; in the remote command

Closes #3603

gemini-code-assist · 2026-03-13T02:47:58Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

coderabbitai · 2026-03-13T02:48:05Z

Warning

Rate limit exceeded

@alex-solovyev has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 1 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b1d4a14a-ad40-4adb-8a69-3820f3244b0d

📥 Commits

Reviewing files that changed from the base of the PR and between ad2237e and e5c4263.

📒 Files selected for processing (1)

.agents/scripts/wp-helper.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch bugfix/GH-3603-wp-helper-command-injection

📝 Coding Plan

Generate coding plan for human review comments

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-03-13T02:48:24Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

�[0;34m[INFO]�[0m Latest Quality Status:
SonarCloud: 0 bugs, 0 vulnerabilities, 413 code smells

�[0;34m[INFO]�[0m Recent monitoring activity:
Fri Mar 13 02:48:20 UTC 2026: Code review monitoring started
Fri Mar 13 02:48:20 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 413

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 413
VULNERABILITIES: 0

Generated on: Fri Mar 13 02:48:23 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

marcusquinn · 2026-03-13T04:30:37Z

Dispatching worker for failing CI remediation.

Model: default alternating headless provider
Branch: bugfix/quality-debt: PR #436 review feedback (critical) #3603-wp-helper-command-injection
Scope: diagnose failing checks and implement smallest correct fix to make CI pass
Attempt: 1 of 1
Direction: preserve existing PR scope and keep issue linkage intact

marcusquinn · 2026-03-13T04:34:09Z

Dispatching worker for failing CI remediation.\n- Model: default alternating headless provider\n- Branch: bugfix/GH-3603-wp-helper-command-injection\n- Scope: diagnose failing checks and implement smallest correct fix to make CI pass\n- Attempt: 1 of 1\n- Direction: preserve existing PR scope and keep issue linkage intact

marcusquinn · 2026-03-13T04:37:29Z

Initial worker launch validation failed; re-dispatching immediately with explicit provider fallback.\n- Correction: relaunch using openai/gpt-5.3-codex\n- Reason: launch gate reported invalid startup for previous attempt

alex-solovyev · 2026-03-13T07:03:27Z

PR has merge conflicts (DIRTY) after sibling PRs merged. Dispatching worker to rebase.

Model: sonnet (anthropic/claude-sonnet-4-6)
Branch: bugfix/quality-debt: PR #436 review feedback (critical) #3603-wp-helper-command-injection
Scope: Rebase branch onto main, resolve conflicts, push
Attempt: 1 of 1

… injection GH#3603: The PR #436 refactor of wp-helper.sh introduced a command injection vulnerability by interpolating $wp_command directly into the SSH remote command string without quoting. If wp_command contained shell metacharacters (e.g. semicolons, backticks, $(...)), they would be interpreted by the remote shell. Fix: use printf '%q ' to shell-quote each word of wp_command before embedding it in the remote command string. The localwp case (local execution via cd+wp) is unaffected as it uses word-splitting intentionally for direct execution. ShellCheck -S error passes.

github-actions · 2026-03-13T07:05:32Z

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

�[0;34m[INFO]�[0m Latest Quality Status:
SonarCloud: 0 bugs, 0 vulnerabilities, 412 code smells

�[0;34m[INFO]�[0m Recent monitoring activity:
Fri Mar 13 07:05:28 UTC 2026: Code review monitoring started
Fri Mar 13 07:05:28 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 412

📈 Current Quality Metrics

BUGS: 0
CODE SMELLS: 412
VULNERABILITIES: 0

Generated on: Fri Mar 13 07:05:30 UTC 2026

Generated by AI DevOps Framework Code Review Monitoring

sonarqubecloud · 2026-03-13T07:06:23Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions bot added the bug Auto-created from TODO.md tag label Mar 13, 2026

marcusquinn mentioned this pull request Mar 13, 2026

[Supervisor:marcusquinn] 0 PRs, 0 assigned, 0 workers at 08:05 UTC #2645

Open

alex-solovyev mentioned this pull request Mar 13, 2026

[Supervisor:alex-solovyev] 13 PRs, 16 assigned, 6 workers at 06:15 UTC #2646

Closed

marcusquinn mentioned this pull request Mar 13, 2026

Systemic CI failure: Codacy Static Code Analysis (2 events) #4346

Closed

alex-solovyev mentioned this pull request Mar 13, 2026

[Supervisor:alex-solovyev] 11 PRs, 16 assigned, 13 workers at 07:00 UTC #4359

Closed

alex-solovyev and others added 2 commits March 13, 2026 08:04

fix: pass wp-helper args safely through SSH

e5c4263

alex-solovyev force-pushed the bugfix/GH-3603-wp-helper-command-injection branch from 5106f2a to e5c4263 Compare March 13, 2026 07:04

alex-solovyev merged commit 366148a into main Mar 13, 2026
12 checks passed

alex-solovyev deleted the bugfix/GH-3603-wp-helper-command-injection branch March 13, 2026 07:08

github-actions bot mentioned this pull request Mar 13, 2026

quality-debt: PR #436 review feedback (critical) #3603

Closed

This was referenced Mar 13, 2026

fix review-bot-gate-helper.sh: use REST API for PR age when GraphQL is rate-limited #4361

Closed

t4346: fix Codacy CI failures - add .codacy.yml config #4364

Merged

GH#3574: fix remaining quality-debt from PR #263 review feedback #4372

Merged

This was referenced Mar 15, 2026

wp-helper.sh: SSH stdout swallowed — remote WP-CLI output not returned #4937

Closed

bug: wp-helper.sh SSH commands silently fail — argument concatenation destroys bash -c quoting #5197

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GH#3603: fix critical quality-debt from PR #436 review feedback#4338

GH#3603: fix critical quality-debt from PR #436 review feedback#4338
alex-solovyev merged 2 commits intomainfrom
bugfix/GH-3603-wp-helper-command-injection

alex-solovyev commented Mar 13, 2026

Uh oh!

gemini-code-assist bot commented Mar 13, 2026

Uh oh!

coderabbitai bot commented Mar 13, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

github-actions bot commented Mar 13, 2026

Uh oh!

marcusquinn commented Mar 13, 2026

Uh oh!

marcusquinn commented Mar 13, 2026

Uh oh!

marcusquinn commented Mar 13, 2026

Uh oh!

alex-solovyev commented Mar 13, 2026

Uh oh!

github-actions bot commented Mar 13, 2026

Uh oh!

sonarqubecloud bot commented Mar 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alex-solovyev commented Mar 13, 2026

Summary

Root Cause

Fix

Verification

Uh oh!

gemini-code-assist bot commented Mar 13, 2026

Uh oh!

coderabbitai bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

github-actions bot commented Mar 13, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

marcusquinn commented Mar 13, 2026

Uh oh!

marcusquinn commented Mar 13, 2026

Uh oh!

marcusquinn commented Mar 13, 2026

Uh oh!

alex-solovyev commented Mar 13, 2026

Uh oh!

github-actions bot commented Mar 13, 2026

🔍 Code Quality Report

📈 Current Quality Metrics

Uh oh!

sonarqubecloud bot commented Mar 13, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai bot commented Mar 13, 2026 •

edited

Loading