Block access to .scss, .sass, .less, .pcss and .pcss.css files

The Needs Review Queue Bot → tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

Adding the patch against Drupal 10.1.x-dev. No interdiff since the previous patch does not apply.

Sass has two syntaxes! The SCSS syntax (.scss) is used most commonly. It's a superset of CSS, which means all valid CSS is also valid SCSS. The indented syntax (.sass) is more unusual: it uses indentation rather than curly braces to nest statements, and newlines instead of semicolons to separate them. All our examples are available in both syntaxes.

See https://sass-lang.com/documentation/syntax

.sass is a valid sass file extension. Meanwhile, .less is a similar one (e.g. Less is used in Bootstrap 3)

So I would suggest securing .sass and .less files as well.

Meanwhile, HtaccessTest, core/assets/scaffold/files/web.config, web.config, should be updated

A CR is required I think.

The last submitted patch, 23: 3190045-23.patch, failed testing. View results →

Add 3 files: access_test.scss, access_test.sass and access_test.less for testing.

Should pcss.css files be added to that list?

Right

.pcss.css file exists in Drupal see https://api.drupal.org/api/drupal/core%21themes%21olivero%21css%21base%2...
.pcss is in use, see #3151341: Change the PostCSS file extension to pcss →

Tested this on ddev, Drupal 10.1 with an apache-fpm server.
Visited https://drupal-10-x.ddev.site:8443/core/themes/claro/css/components/acti... and got an access denied.

Reviewed Patch on #34, access has been successfully invoked, can be merged now.

The Needs Review Queue Bot → tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

Update core/scripts/css/postcss-build.js to ignore core/modules/system/tests/fixtures/HtaccessTest/access_test.pcss.css

Seems to have a CI failure.

Added a dummy comment to the .pcss.css file and generated its associated .css file for testing.

Made a wrong file extension

FYI, change made to core/scripts/dev/commit-code-check.sh in change[#3343495] failed #34

+++ b/core/assets/scaffold/files/web.config
--- /dev/null
+++ b/core/modules/system/tests/fixtures/HtaccessTest/access_test.css

+++ b/core/modules/system/tests/fixtures/HtaccessTest/access_test.css
@@ -0,0 +1,6 @@
+/*
+ * DO NOT EDIT THIS FILE.
+ * See the following change record for more information,
+ * https://www.drupal.org/node/3084859
+ * @preserve
+ *//* foo */

--- /dev/null
+++ b/core/modules/system/tests/fixtures/HtaccessTest/access_test.pcss.css

+++ b/core/modules/system/tests/fixtures/HtaccessTest/access_test.pcss.css
@@ -0,0 +1 @@
+/* foo */

Changes since #34

Looks good now!

Reviewed the Patch on #42, works for me, so issue noticed.thanks

The last submitted patch, 42: 3190045-41.patch, failed testing. View results →

Random failure.

The last submitted patch, 42: 3190045-41.patch, failed testing. View results →

The failure occurred in the testContextualLinks function, where there was an assertion failure due to a NULL value being evaluated as empty.

Random failure

The last submitted patch, 42: 3190045-41.patch, failed testing. View results →

Given the previous comments and the issue reported, I think it is again random failure.

The Needs Review Queue Bot → tested this issue. It fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

This does not mean that the patch needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

We are working on this issue at DrupalCon Portland 2024

fengtan → changed the visibility of the branch 11.x to hidden.