Apply the style package allowlist to nested entries

[erseco]

Stacked on #136.

Security fix: style package allowlist bypass

ExeLearning_Style_Package::verify_entries() skipped every entry that contained a / before checking its extension, whenever config.xml sat at the archive root. So a style ZIP could write x/shell.php or x/.htaccess into uploads/exelearning-styles/{slug}/x/. That directory has no deny-PHP guard, so the result was server-side code execution.

Uploading a style package requires manage_options. The fix matters most where that is not the same as full server access:

• multisite sub-site admins;
• sites with DISALLOW_FILE_MODS or DISALLOW_FILE_EDIT.

Change

• Only directory entries (names ending in /) are skipped. Every file, at any depth, must have an allowed extension. The single-root check still runs first, so a directory outside the root folder (evil/ next to acme/) is rejected with zip_mixed_roots.
• Rejection messages now esc_html() the entry name. Core prints settings errors unescaped, so a crafted entry name rendered as markup in wp-admin (a low-severity self-XSS).

Behaviour changes

• Bug fix: single-root-folder packages that contain directory entries (acme/, acme/img/) are now accepted. Before, those entries failed the extension check, and most ZIP tools store them.
• Root-config packages with extensionless or unlisted files in subfolders (for example fonts/LICENSE) are now rejected. The bundled eXeLearning themes only use allowed extensions.

Tests

• New tests:
  • nested x/shell.php, x/.htaccess, x/.user.ini, deep/er/a.phtml and fonts/LICENSE are rejected;
  • directory entries are accepted, in both the root and the prefixed layout;
  • a directory outside the root folder is rejected;
  • the entry name is escaped in the rejection message.
• StylesServiceTest's icon fixture no longer includes icons/no-extension, which only installed because of the bypass. readme.txt in the same fixture still covers skipping non-image files.
• Full suite: OK (952 tests).

[github-actions]

Test in WordPress Playground

Test the plugin with the code from this branch:

ℹ️ The eXeLearning editor is fetched from the shared release and unpacked into the plugin when the playground boots, so the first load may take a few extra seconds. ELP upload, shortcode, Gutenberg block and preview work normally.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.87%. Comparing base (704e330) to head (f44aa80).

Additional details and impacted files

@@                     Coverage Diff                     @@
##             hotfix/test-isolation     #137      +/-   ##
===========================================================
- Coverage                    96.87%   96.87%   -0.01%     
  Complexity                     864      864              
===========================================================
  Files                           39       39              
  Lines                         4323     4322       -1     
===========================================================
- Hits                          4188     4187       -1     
  Misses                         135      135              

Flag	Coverage Δ
javascript	95.70% <ø> (ø)
php	97.25% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
includes/class-style-package.php	96.06% <100.00%> (-0.02%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.