[Blueprints] Keep directory theme writes inside the target folder

[adamziel]

What it does

Prevents directory-based theme installs from writing outside the intended theme folder.

Rejected examples:

{ "themeData": { "name": "../escape" } }
{ "options": { "targetFolderName": "nested/theme" } }
{ "themeData": { "files": { "../escape.php": "..." } } }

Rationale

Zip-based theme installs go through installAsset(), which moves one resolved asset folder into wp-content/themes.

Directory resources skip installAsset() and pass caller-provided names and file keys directly to writeFiles(). Without an explicit boundary check, ../ segments can resolve outside the theme directory before the files are written.

Blueprint v2 lowering emits directory resources, so this needs to be enforced before the v2 runner depends on that path.

Implementation

Uses the existing POSIX path utilities instead of local string parsing:

• installTheme() requires the resolved directory theme target to be a single directory name by checking basename(assetFolderName) === assetFolderName.
• writeFiles() computes each destination with joinPaths(root, relativePath) and rejects it unless isParentOf(root, filePath) is true.

The writeFiles() guard is intentionally shared: any FileTree write now stays inside the root passed by the caller.

This does not add symlink hardening or change zip install behavior.

Testing instructions

npm run format:uncommitted
npm exec nx run playground-blueprints:test:vite -- --testFiles=packages/playground/blueprints/src/tests/steps/install-theme.spec.ts
npm exec nx run php-wasm-node:test-group-5-asyncify -- --testFiles=write-files.spec.ts
npm exec nx run php-wasm-universal:typecheck
npm exec nx run playground-blueprints:typecheck
npm exec nx run php-wasm-node:typecheck
npm exec nx run playground-blueprints:lint
npm exec nx run php-wasm-universal:lint
npm exec nx run php-wasm-node:lint
git diff --check

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens directory-based theme installs and generic file-tree writes to prevent path traversal outside the intended target folder.

Changes:

• Validates directory-theme target folder names to be a single directory segment.
• Adds a root-boundary guard in writeFiles() to reject writes outside the provided root.
• Adds regression tests for theme install and writeFiles() traversal cases.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
packages/playground/blueprints/src/lib/steps/install-theme.ts	Adds validation to keep directory theme installs confined to a single folder name.
packages/php-wasm/universal/src/lib/write-files.ts	Enforces that each written path stays inside the caller-provided root directory.
packages/playground/blueprints/src/tests/steps/install-theme.spec.ts	Adds tests covering invalid theme folder names and file paths.
packages/php-wasm/node/src/test/write-files.spec.ts	Adds a test ensuring traversal paths are rejected by writeFiles().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.