Fix false positive for files with only require_once and class definitions by GeorgeWebDevCy · Pull Request #1369 · WordPress/plugin-check

GeorgeWebDevCy · 2026-06-20T20:05:28Z

…ions.

github-actions · 2026-06-20T20:05:38Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: GeorgeWebDevCy <orionaselite@git.wordpress.org>
Co-authored-by: davidperezgar <davidperez@git.wordpress.org>
Co-authored-by: ernilambar <nilambar@git.wordpress.org>
Co-authored-by: marekdedic <marekdedic@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

davidperezgar · 2026-06-21T09:16:20Z

Thanks @GeorgeWebDevCy for your contribution. You need to review the tests that are failing before we can review the PR.

GeorgeWebDevCy · 2026-06-21T11:19:57Z

Thanks for the heads up. I reviewed the failing tests and pushed a follow-up fix in 3813175. The CI matrix is now passing.

…ositive

ernilambar · 2026-07-07T11:19:55Z

        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
        with:
-          file: build/logs/*.xml
+          files: build/logs/*.xml


Why this change?

This updates the input name for the pinned Codecov action. At commit fb8b3582c8e4def4969c97caa2f19720cb33a72f, the action defines files (a comma-separated list of explicit coverage files) and passes it through as INPUT_FILES; it does not define a file input. Both occurrences use the same build/logs/*.xml pattern, so this makes the workflow use the action's supported input without changing which reports we intend to upload.

…ositive

davidperezgar · 2026-08-01T09:04:48Z

Thanks to Codex’s review, I found a potential false negative in the new include handling.

Any include/require is now considered safe whenever the file contains a class, interface, trait, or enum. However, including a file executes it, so a class file that requires a bootstrap file with procedural code could be accessed directly without a guard and would no longer be reported.

Could we avoid skipping arbitrary includes, or verify that the included file is also structural-only? It would also be helpful to add a regression test for a class file that requires a file containing executable code.

Copilot

Copilot review overview

🟡 Changes recommended

The new AST allowance for include/require can incorrectly treat dynamic include targets as safe, and the new test fixture references a missing dependency file.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3

Open (3)

Validate include targets before granting direct-access exemption · New
Continue scanning after namespaces without declarations · New
Add missing class-parent.php test fixture · New

What changed in this PR

This PR updates the Direct File Access check to avoid flagging PHP files that only load dependencies (via require_once) and declare classes/interfaces/traits/enums—addressing the reported false positive in #1361.

Changes:

Allow include/require AST expressions in otherwise “structural-only” files.
Add a PHPUnit fixture and assertion covering require_once + class-only files.
Update Codecov upload config in the PHP test workflow to use the files input.

File	Description
includes/Checker/Checks/Plugin_Repo/Direct_File_Access_Check.php	Adjusts AST/regex heuristics for determining whether a file is safe for direct access.
tests/phpunit/tests/Checker/Checks/Direct_File_Access_Check_Tests.php	Extends the existing PHPUnit coverage to assert the new “require_once + class-only” case is not flagged.
tests/phpunit/testdata/plugins/test-plugin-direct-file-access-without-errors/includes/require-once-class-only.php	Adds a new test fixture file that matches the reported false-positive scenario.
.github/workflows/php-test.yml	Aligns Codecov upload configuration with other workflows by using `files:`.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

 			if ( $node instanceof Stmt\Expression ) {
+				if ( $node->expr instanceof Expr\Include_ && $has_structural_declaration ) {
+					continue;
+				}
+


+			if ( $node instanceof Stmt\Namespace_ && ! empty( $node->stmts ) ) {
+				return $this->has_structural_declaration( $node->stmts );
+			}


+ * File with require_once and class - safe for direct access.
+ */
+
+require_once __DIR__ . '/class-parent.php';


Fix false positive for files with only require_once and class definit…

a1fd686

…ions.

GeorgeWebDevCy requested review from chriscct7, davidperezgar, ernilambar and frantorres as code owners June 20, 2026 20:05

Fix include handling for direct file access check

3813175

GeorgeWebDevCy and others added 5 commits June 21, 2026 14:23

Fix Codecov workflow inputs

63ec4d5

Merge branch 'trunk' into fix/direct-file-access-require-once-false-p…

dc07d88

…ositive

Merge branch 'trunk' into fix/direct-file-access-require-once-false-p…

3412eb5

…ositive

Merge branch 'trunk' into fix/direct-file-access-require-once-false-p…

f76aaa3

…ositive

Merge branch 'trunk' into fix/direct-file-access-require-once-false-p…

4a26f7b

…ositive

ernilambar reviewed Jul 7, 2026

View reviewed changes

Merge branch 'trunk' into fix/direct-file-access-require-once-false-p…

bbf080b

…ositive

swissspidy mentioned this pull request Aug 19, 2026

Request: Do not update plugin-check silently without a new version of this action WordPress/plugin-check-action#527

Open

ernilambar requested a lite review from Copilot September 21, 2026 15:32

Copilot started reviewing on behalf of ernilambar September 21, 2026 15:32 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Navigation Menu

Fix false positive for files with only require_once and class definitions - #1369

Fix false positive for files with only require_once and class definitions#1369
GeorgeWebDevCy wants to merge 8 commits into
WordPress:trunkfrom
GeorgeWebDevCy:fix/direct-file-access-require-once-false-positive

GeorgeWebDevCy commented Jun 20, 2026 •

edited by github-actions Bot

Loading

Uh oh!

github-actions Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

davidperezgar commented Jun 21, 2026

Uh oh!

GeorgeWebDevCy commented Jun 21, 2026

Uh oh!

ernilambar Jul 7, 2026

Uh oh!

GeorgeWebDevCy Jul 31, 2026

Uh oh!

davidperezgar commented Aug 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

GeorgeWebDevCy commented Jun 20, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

davidperezgar commented Jun 21, 2026

Uh oh!

GeorgeWebDevCy commented Jun 21, 2026

Uh oh!

ernilambar Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

GeorgeWebDevCy Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

davidperezgar commented Aug 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

GeorgeWebDevCy commented Jun 20, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jun 20, 2026 •

edited

Loading