From 6063e45548f6d4381336d4457486d2d57b404701 Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Wed, 29 Jul 2026 12:08:46 +0200
Subject: [PATCH] db import: Reject dot-commands in SQLite dump files

---
 features/db-import.feature | 16 ++++++++++++++++
 src/DB_Command_SQLite.php  |  4 ++++
 2 files changed, 20 insertions(+)

diff --git a/features/db-import.feature b/features/db-import.feature
index a650517d..462add04 100644
--- a/features/db-import.feature
+++ b/features/db-import.feature
@@ -248,6 +248,22 @@ Feature: Import a WordPress database
       🍣
       """
 
+  @require-sqlite
+  Scenario: `wp db import` rejects dot-commands in SQLite dump files
+    Given a WP install
+    And a malicious_sqlite.sql file:
+      """
+      CREATE TABLE wp_cli_sqlite_meta (id int NOT NULL);
+      .shell touch side_effect_sqlite.txt
+      """
+
+    When I try `wp db import malicious_sqlite.sql`
+    Then STDERR should contain:
+      """
+      SQLite dot-commands are not allowed in import files.
+      """
+    And the side_effect_sqlite.txt file should not exist
+
   # SQLite does not use the MySQL client and has no concept of SQL modes.
   @require-mysql-or-mariadb
   Scenario: `wp db import` adapts the SQL mode via --init-command by default
diff --git a/src/DB_Command_SQLite.php b/src/DB_Command_SQLite.php
index 77893a00..6a7c107f 100644
--- a/src/DB_Command_SQLite.php
+++ b/src/DB_Command_SQLite.php
@@ -454,6 +454,10 @@ protected function sqlite_import( $file, $assoc_args ) {
 			$contents = (string) file_get_contents( $file );
 		}
 
+		if ( preg_match( '/^\s*\.[a-zA-Z]+/m', $contents ) ) {
+			WP_CLI::error( 'SQLite dot-commands are not allowed in import files.' );
+		}
+
 		// Ignore errors about unique constraints and existing indexes.
 		$contents = str_replace( 'INSERT INTO', 'INSERT OR IGNORE INTO', $contents );
 		$contents = preg_replace( '/\bCREATE TABLE (?!IF NOT EXISTS\b)/i', 'CREATE TABLE IF NOT EXISTS ', $contents );