db import: Pass import file via STDIN redirection

[swissspidy]

Previously, wp db import <file> built a MySQL --execute string by interpolating the import filename into SOURCE %s;. Because MySQL's --execute flag processes client-side directives, filenames with special characters could cause syntax errors or unintended client parsing behavior.

This change modifies wp db import to feed the SQL dump file directly to the mysql client via standard input redirection ( < 'filename'). Any bulk import session optimizations (SET unique_checks = 0; SET foreign_key_checks = 0;) are now passed via --init-command, matching how session SQL modes are handled.

Summary by CodeRabbit

• Bug Fixes
  • Improved MySQL and MariaDB imports from files and standard input.
  • Prevented special characters in filenames from creating side-effect files.
  • Prevented embedded client commands in database dumps from being executed.
  • Improved import reliability by applying optimization settings safely during imports.

[coderabbitai]

Warning

Review limit reached

@swissspidy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 374d9bf7-59a9-45ae-8d80-fd02b22e5993

📥 Commits

Reviewing files that changed from the base of the PR and between 7da3544 and bdb1450.

📒 Files selected for processing (2)

• features/db-import.feature
• src/DB_Command.php

📝 Walkthrough

Walkthrough

DB_Command::import() now uses safer MySQL import handling for files and STDIN. It adds binary mode, redirects readable files through shell input, and moves optimization settings into --init-command. Regression scenarios cover unsafe filenames and embedded client meta-commands.

Changes

MySQL import hardening

Layer / File(s)	Summary
Update MySQL import execution src/DB_Command.php	import() distinguishes STDIN from files, validates file readability, enables binary-mode, and redirects files through shell input. Optimization settings now use unique_checks and foreign_key_checks in --init-command.
Add import regression scenarios features/db-import.feature	Scenarios verify that unsafe filenames do not create side-effect files and that embedded client meta-commands are not executed.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• wp-cli/db-command#320: Both changes modify DB_Command::import() and MySQL import execution.
• wp-cli/db-command#333: Both changes modify MySQL --init-command handling.
• wp-cli/db-command#340: Both changes harden db import against client directives and side effects.

Suggested labels: bug, scope:testing

Suggested reviewers: schlessera, copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: passing the database import file through STDIN redirection.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/import-source

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates wp db import to avoid building a MySQL --execute string containing a SOURCE <file> directive, and instead feeds the dump file to mysql via STDIN redirection. This reduces risk of client-side parsing issues when import filenames contain special characters, and moves import optimizations into --init-command alongside existing SQL-mode compatibility handling.

Changes:

• Replaced SOURCE %s; via --execute with shell input redirection (mysql < 'file') for file imports.
• Moved bulk import optimization statements to --init-command, composing with any existing --init-command.
• Added Behat coverage for special-character filenames and for preventing client meta-command side effects.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/DB_Command.php	Switches file imports to STDIN redirection and composes optimization SQL into --init-command.
features/db-import.feature	Adds scenarios to cover special-character filenames and client meta-command injection attempts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@features/db-import.feature`:
- Around line 387-392: Strengthen the scenario around the `When I run wp db
import` step by querying `wp_cli_meta_test` after the import and asserting the
expected inserted value, while retaining the existing success-output and
side-effect-file assertions. This must verify that the specially named SQL file
was actually processed rather than merely exiting successfully.

In `@src/DB_Command.php`:
- Around line 983-990: Update the inline documentation for the
--skip-optimization option near the command’s argument definitions to match the
implementation in the optimization SQL block: state that optimization applies to
both SQL files and STDIN imports, and that it disables unique and foreign-key
checks only rather than auto-commit.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a5b7c418-f29b-4046-8a00-ce9b59c119ec

📥 Commits

Reviewing files that changed from the base of the PR and between 0455621 and 7da3544.

📒 Files selected for processing (2)

• features/db-import.feature
• src/DB_Command.php

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!