Tighten asset combiner import confinement and error output

modules/system/classes/CombineAssets.php

@@ -10,6 +10,7 @@
 use Config;
 use Request;
 use Response;
+use Str;
 use Assetic\Asset\FileAsset;
 use Assetic\Asset\AssetCache;
 use Assetic\Asset\AssetCollection;
@@ -135,7 +136,7 @@ public function init()
         // explicit roots, a writable asset could disclose arbitrary server-readable
         // files: `@import (inline) "<path>"` in a .less file (GHSA-58fp-mcx6-7qf9),
         // `=include ../../../.env` in a .js file (GHSA-2223-f22x-24cq), or an
-        // `@import` traversal in a .css file. The asset's own source directory is
+        // `@import` traversal in a .scss or .css file. The asset's own source directory is
         // always allowed implicitly; this list adds the cross-tree roots that
         // legitimate themes/plugins/modules actually import from (e.g. a plugin
         // importing a module asset, or a theme importing its own ../vendor).
@@ -158,7 +159,14 @@ public function init()
         $cssImportFilter = new CssImportFilter;
         // Assetic's CssImportFilter resolves `@import` targets relative to the source
         // with `..` traversal allowed; confine the resolved path to the allowed roots.
+        // Targets it would load as a URL instead (anything with a scheme, or a
+        // protocol-relative `//`) are not paths the root check can judge, so they are
+        // refused and left in the output for the browser to resolve.
         $cssImportFilter->setImportValidator(function ($path) use ($allowedImportRoots) {
+            if (Str::contains($path, '://') || Str::startsWith($path, '//')) {
+                return false;
+            }
+
             $resolved = PathResolver::resolve($path);
 
             return $resolved !== false
@@ -170,7 +178,10 @@ public function init()
         $lessCompiler = new LessCompiler;
         $lessCompiler->setAllowedImportRoots($allowedImportRoots);
         $this->registerFilter('less', $lessCompiler);
-        $this->registerFilter('scss', new ScssCompiler);
+
+        $scssCompiler = new ScssCompiler;
+        $scssCompiler->setAllowedImportRoots($allowedImportRoots);
+        $this->registerFilter('scss', $scssCompiler);
 
         /*
          * Minification filters

modules/system/classes/SystemController.php

@@ -38,6 +38,13 @@ public function combine($name)
 
             return $combiner->getContents($cacheId);
         } catch (Exception $ex) {
+            // Compiler errors quote source lines and absolute paths, so only show them in debug mode.
+            if (!Config::get('app.debug', false)) {
+                report($ex);
+
+                return Response::make('/* '.e(Lang::get('system::lang.combiner.error')).' */', 500);
+            }
+
             return Response::make('/* '.e($ex->getMessage()).' */', 500);
         }
     }

modules/system/lang/en/lang.php

@@ -58,6 +58,7 @@
     ],
     'combiner' => [
         'not_found' => "The combiner file ':name' is not found.",
+        'error' => 'The combined file could not be generated.',
     ],
     'system' => [
         'name' => 'System',