Add strict slug validation for plugin-tests and theme-tests commands

features/scaffold-block.feature

@@ -31,8 +31,7 @@ Feature: WordPress block code scaffolding
       """
 
   Scenario: Scaffold a block for an invalid plugin slug
-    When I run `wp scaffold plugin plugin.name.with.dots`
-    And I try `wp scaffold block some-block --plugin=plugin.name.with.dots`
+    When I try `wp scaffold block some-block --plugin=plugin.name.with.dots`
     Then STDERR should contain:
       """
       Error: Invalid plugin name specified.

features/scaffold-plugin-tests.feature

@@ -236,7 +236,21 @@ Feature: Scaffold plugin unit tests
     When I try `wp scaffold plugin-tests ../`
     Then STDERR should be:
       """
-      Error: Invalid plugin slug specified. The target directory '{RUN_DIR}/wp-content/plugins/../' is not in '{RUN_DIR}/wp-content/plugins'.
+      Error: Invalid plugin slug specified. The slug can only contain alphanumeric characters, underscores, and dashes.
+      """
+    And the return code should be 1
+
+    When I try `wp scaffold plugin-tests my-plugin/`
+    Then STDERR should be:
+      """
+      Error: Invalid plugin slug specified. The slug can only contain alphanumeric characters, underscores, and dashes.
+      """
+    And the return code should be 1
+
+    When I try `wp scaffold plugin-tests my-plugin\\`
+    Then STDERR should be:
+      """
+      Error: Invalid plugin slug specified. The slug can only contain alphanumeric characters, underscores, and dashes.
       """
     And the return code should be 1
 

features/scaffold-theme-tests.feature

@@ -215,7 +215,21 @@ Feature: Scaffold theme unit tests
     When I try `wp scaffold theme-tests ../`
     Then STDERR should be:
       """
-      Error: Invalid theme slug specified. The target directory '{RUN_DIR}/wp-content/themes/../' is not in '{RUN_DIR}/wp-content/themes'.
+      Error: Invalid theme slug specified. The slug can only contain alphanumeric characters, underscores, and dashes.
+      """
+    And the return code should be 1
+
+    When I try `wp scaffold theme-tests t12child/`
+    Then STDERR should be:
+      """
+      Error: Invalid theme slug specified. The slug can only contain alphanumeric characters, underscores, and dashes.
+      """
+    And the return code should be 1
+
+    When I try `wp scaffold theme-tests t12child\\`
+    Then STDERR should be:
+      """
+      Error: Invalid theme slug specified. The slug can only contain alphanumeric characters, underscores, and dashes.
       """
     And the return code should be 1
 

src/Scaffold_Command.php

@@ -828,9 +828,13 @@
 
 		if ( ! empty( $args[0] ) ) {
 			$slug = $args[0];
+			// Validate slug contains only alphanumeric characters, underscores, and dashes.
 			if ( in_array( $slug, [ '.', '..' ], true ) ) {
 				WP_CLI::error( "Invalid {$type} slug specified. The slug cannot be '.' or '..'." );
 			}
+			if ( ! preg_match( '/^[a-zA-Z0-9_-]+$/', $slug ) ) {
+				WP_CLI::error( "Invalid {$type} slug specified. The slug can only contain alphanumeric characters, underscores, and dashes." );
+			}
 			if ( 'theme' === $type ) {
 				$theme = wp_get_theme( $slug );
 				if ( $theme->exists() ) {
@@ -841,11 +845,11 @@
 			} else {
 				$target_dir = WP_PLUGIN_DIR . "/{$slug}";
 			}
 			if ( empty( $assoc_args['dir'] ) && ! is_dir( $target_dir ) ) {
 				WP_CLI::error( "Invalid {$type} slug specified. No such target directory '{$target_dir}'." );
 			}
 
 			$error_msg = $this->check_target_directory( $type, $target_dir );
 			if ( ! empty( $error_msg ) ) {
 				WP_CLI::error( "Invalid {$type} slug specified. {$error_msg}" );
 			}
@@ -858,6 +862,13 @@
 			}
 			if ( empty( $slug ) ) {
 				$slug = Utils\basename( $target_dir );
+				// Validate derived slug as well.
+				if ( in_array( $slug, [ '.', '..' ], true ) ) {
+					WP_CLI::error( "Invalid {$type} slug specified. The slug cannot be '.' or '..'." );
+				}
+				if ( ! preg_match( '/^[a-zA-Z0-9_-]+$/', $slug ) ) {
+					WP_CLI::error( "Invalid {$type} slug specified. The slug can only contain alphanumeric characters, underscores, and dashes." );
+				}
 			}
 		}
 
@@ -865,19 +876,19 @@
 			WP_CLI::error( "Invalid {$type} specified." );
 		}
 
 		$name    = ucwords( str_replace( '-', ' ', $slug ) );
 		$package = str_replace( ' ', '_', $name );
 
 		$tests_dir = "{$target_dir}/tests";
 		$bin_dir   = "{$target_dir}/bin";
 
 		$wp_filesystem->mkdir( $tests_dir );
 		$wp_filesystem->mkdir( $bin_dir );
 
 		$wp_versions_to_test = [];
 		// Parse plugin readme.txt
 		if ( file_exists( "{$target_dir}/readme.txt" ) ) {
 			$readme_content = (string) file_get_contents( "{$target_dir}/readme.txt" );
 
 			preg_match( '/Requires at least\:(.*)\n/m', $readme_content, $matches );
 			if ( isset( $matches[1] ) && $matches[1] ) {
@@ -887,7 +898,7 @@
 		$wp_versions_to_test[] = 'latest';
 		$wp_versions_to_test[] = 'trunk';
 
 		$main_file = "{$slug}.php";
 
 		if ( 'plugin' === $type ) {
 			if ( ! function_exists( 'get_plugins' ) ) {
@@ -899,7 +910,7 @@
 			if ( ! empty( $all_plugins ) ) {
 				$filtered = array_filter(
 					array_keys( $all_plugins ),
 					static function ( $item ) use ( $slug ) {
 						return ( false !== strpos( $item, "{$slug}/" ) );
 					}
 				);