Confine asset compiler imports consistently across LESS and SCSS

[LukeTowers]

Two gaps in how @import resolution is bounded to the asset tree.

Requires assetic/framework v3.2.3 (assetic-php/assetic#53), released 2026-09-15 — composer.json is bumped accordingly.

LESS — confinement didn't follow the import graph

LessImportResolver bounds resolution by colliding with the path-form import dir less.php auto-adds for the current file's directory. That entry is re-created for every file less.php parses, keyed by that file's own directory — and it's also consulted by data-uri() / image-size(). We only claimed the entry asset's directory, so anything imported from another directory resolved unconfined.

makeResolver() now registers a resolver for each directory it admits, so the collision follows the import graph. The key-normalisation moves into importDirKey() so registration and the initial build share one implementation — worth keeping in one place, since getting it wrong doesn't fail loudly, it just silently stops colliding (and differs on Windows).

SCSS — never wired up at all

LESS, CSS and JavaScript all got the allowed-root policy; ScssCompiler never did. scssphp resolves @import against the configured import paths and the importing file's own directory, both with .. traversal allowed.

ScssCompiler now uses HasAllowedImportRoots and installs a validator through the new assetic hook. Import paths configured on the filter are mirrored into the allowed roots so legitimate cross-tree imports still resolve — the parent stores them privately, hence the local mirror.

Tests

+9, all verified in both directions by reverting each fix and re-running:

LessCompilerTest — testBlocksTraversalFromAnImportedSubdirectoryFile and testBlocksDataUriFileReadFromAnImportedSubdirectoryFile both fail without the resolver change. testAllowsNestedPartialChain guards the legitimate case.

ScssCompilerTest (new, mirrors LessCompilerTest) — the three confinement tests fail without the compiler change; testAllowsLegitimateSameTreePartial, testAllowsNestedPartialChain and testAllowsCrossTreeImportWhenRootIsWhitelisted guard normal use.

Full suite: 837 tests, 3324 assertions, 0 failures (828 before). phpcs clean — includes removing one stray blank line in LessCompilerTest that pre-dates this branch but would now be linted as a changed file.

Summary by CodeRabbit

• Bug Fixes

  • Restricted LESS and SCSS imports to the asset’s directory and explicitly allowed locations.
  • Blocked path traversal, absolute-path imports, and unintended file reads from nested imported files.
  • Preserved valid same-tree, nested, and explicitly approved cross-directory imports, including imports from the entry asset’s directory.

• Security

  • Improved protection against unintended access to files outside configured import locations.

• Tests

  • Added coverage for blocked traversal scenarios and supported nested import workflows.

[LukeTowers]

Re the CodeRabbit nitpick on ScssCompilerTest fixtures: not applying it. PathResolver::standardize() converts to backslashes on Windows, which is exactly what that line avoids (backslashes are escapes in SCSS string literals). file_put_contents() matches LessCompilerTest, and atomic writes add nothing for test fixtures.