Restrict packages directory permissions to 0700

[swissspidy]

Restricts directory permissions for ~/.wp-cli/packages (or WP_CLI_PACKAGES_DIR) to 0700 upon creation in Package_Command::create_default_composer_json().

Previously, 0777 was passed to mkdir(), which masked permissions using the active umask (e.g. 002 or 000). This left the package directory group- or world-writable on environments with permissive umasks, exposing users to potential local code execution via the package autoloader.

Summary by CodeRabbit

• Bug Fixes
  • Improved security for generated Composer package directories by restricting permissions to the owner.
• Tests
  • Added coverage to verify the updated directory permissions on supported systems.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 63117de6-868c-4f36-9c6f-608d03105610

📥 Commits

Reviewing files that changed from the base of the PR and between e33f1a1 and 2e0524e.

📒 Files selected for processing (2)

• src/Package_Command.php
• tests/phpunit/ComposerJsonTest.php

---

📝 Walkthrough

Walkthrough

The default Composer packages directory now uses 0700 permissions instead of 0777. A non-Windows PHPUnit assertion verifies the generated directory permissions.

Changes

Composer directory permissions

Layer / File(s)	Summary
Restrictive directory mode and validation src/Package_Command.php, tests/phpunit/ComposerJsonTest.php	The generated Composer directory uses 0700 permissions. The test verifies this mode on non-Windows systems.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: copilot, brianhenryie

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: restricting the packages directory permissions to 0700.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR tightens security around WP-CLI community packages by creating the packages composer directory with owner-only permissions, reducing exposure to local privilege/code-execution risks from a group/world-writable packages directory.

Changes:

• Change Package_Command::create_default_composer_json() to create the composer directory with 0700 instead of 0777.
• Add a PHPUnit assertion to verify the created directory permissions on non-Windows systems.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Package_Command.php	Creates the packages composer directory with owner-only permissions (0700).
tests/phpunit/ComposerJsonTest.php	Adds an automated check to validate the packages directory permissions after creation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.