Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Default source file limit rejects current WooCommerce package

Open
  • Is something wrong?
#2,242 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
security, testing-qa

Research direction

Start at the generic extraction admission boundary around DEFAULT_MAX_EXTRACTED_FILES and inspect the existing archive safeguards. Use the canonical SSI fixture 20-switchback-woocommerce-extra-hard and the WooCommerce 11.0.0 package as reproduction inputs. Done means bounded trusted-source limits admit the valid package, over-limit archives remain rejected, protections stay fail closed, and tests cover both cases.

Written by the indexing model from the issue text.

Description

Problem

WP Codebox rejects the current official WooCommerce 11.0.0 package before Playground boot because its extracted 5,872 files exceed DEFAULT_MAX_EXTRACTED_FILES = 5,000. Canonical SSI fixture 20-switchback-woocommerce-extra-hard correctly resolves the immutable WordPress.org package and passes staged-artifact dependency discovery with PR #2241, but both its initial and isolated runtime attempts fail admission with Recipe source extraction contains too many files: 5872.

The immutable fixture and official package must remain unchanged. The generic extraction boundary needs a bounded policy that admits current legitimate provider packages while retaining zip-bomb and resource protections.

Evidence

  • Source: https://downloads.wordpress.org/plugin/woocommerce.11.0.0.zip
  • SHA-256: ba08c7fc58c98a11f22866269c5832d85c52b664806ec206036f09737ba21666
  • Extracted count: 5,872
  • Current default: 5,000
  • Failure occurs before Playground/import/editor/visual execution.

Acceptance

  • Current official WooCommerce packages are admitted under a still-bounded extraction policy.
  • Archive file-count, expanded-byte, per-file, path, and compression-ratio protections remain fail closed.
  • Limits are explicit in source provenance/diagnostics and can be configured by trusted recipe-source class rather than silently unbounded.
  • Tests cover a valid package above 5,000 files and an over-limit archive rejection.
  • Canonical fixture 20 reaches import without fixture or package changes.

AI assistance

OpenAI gpt-5.6-sol via OpenCode and a general OpenCode subagent ran the immutable fixture with the WP Codebox #2241 candidate, isolated the pre-runtime file-count admission boundary, and drafted the generic bounded policy contract. Chris Huber directed the investigation and remains responsible for the issue and resulting change.

Dominant language
TypeScript
Stars
17
Forks
4
Avg merge
1h 37m
Merged PRs (30d)
45

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Automattic/wp-codebox

All issues in Automattic/wp-codebox

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.