feature #52712 [AssetMapper] Exclude dot files (weaverryan)

This PR was merged into the 6.4 branch.

Discussion
----------

[AssetMapper] Exclude dot files

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | yes - could possibly be considered a security fix
| New feature?  | yes
| Deprecations? | no
| Issues        | Fix #52697
| License       | MIT

See #52697. The biggest question is: should we do this? Is it enough to say "Hey! When you map an assets directory, EVERYTHING is published publicly?". Or should we be on the safe side and exclude dot files by default.

Cheers!

Commits
-------

85c0ef6b41 [AssetMapper] Adding an option (true by default) to not publish dot files

Author: fabpot

DependencyInjection/Configuration.php

@@ -899,6 +899,11 @@ private function addAssetMapperSection(ArrayNodeDefinition $rootNode, callable $
                             ->prototype('scalar')->end()
                             ->example(['*/assets/build/*', '*/*_.scss'])
                         ->end()
+                        // boolean called  defaulting to true
+                        ->booleanNode('exclude_dotfiles')
+                            ->info('If true, any files starting with "." will be excluded from the asset mapper')
+                            ->defaultTrue()
+                        ->end()
                         ->booleanNode('server')
                             ->info('If true, a "dev server" will return the assets from the public directory (true in "debug" mode only by default)')
                             ->defaultValue($this->debug)

DependencyInjection/FrameworkExtension.php

@@ -1351,7 +1351,8 @@ private function registerAssetMapperConfiguration(array $config, ContainerBuilde
 
         $container->getDefinition('asset_mapper.repository')
             ->setArgument(0, $paths)
-            ->setArgument(2, $excludedPathPatterns);
+            ->setArgument(2, $excludedPathPatterns)
+            ->setArgument(3, $config['exclude_dotfiles']);
 
         $container->getDefinition('asset_mapper.public_assets_path_resolver')
             ->setArgument(0, $config['public_prefix']);

Resources/config/asset_mapper.php

@@ -74,6 +74,7 @@
                 abstract_arg('array of asset mapper paths'),
                 param('kernel.project_dir'),
                 abstract_arg('array of excluded path patterns'),
+                abstract_arg('exclude dot files'),
             ])
 
         ->set('asset_mapper.public_assets_path_resolver', PublicAssetsPathResolver::class)

Resources/config/schema/symfony-1.0.xsd

@@ -196,6 +196,7 @@
             <xsd:element name="importmap-script-attribute" type="asset_mapper_attribute" minOccurs="0" maxOccurs="unbounded" />
         </xsd:sequence>
         <xsd:attribute name="enabled" type="xsd:boolean" />
+        <xsd:attribute name="exclude-dotfiles" type="xsd:boolean" />
         <xsd:attribute name="server" type="xsd:boolean" />
         <xsd:attribute name="public-prefix" type="xsd:string" />
         <xsd:attribute name="missing-import-mode" type="missing-import-mode" />

Tests/DependencyInjection/ConfigurationTest.php

@@ -137,6 +137,7 @@ public function testAssetMapperCanBeEnabled()
             'importmap_polyfill' => 'es-module-shims',
             'vendor_dir' => '%kernel.project_dir%/assets/vendor',
             'importmap_script_attributes' => [],
+            'exclude_dotfiles' => true,
         ];
 
         $this->assertEquals($defaultConfig, $config['asset_mapper']);
@@ -674,6 +675,7 @@ protected static function getBundleDefaultConfig()
                 'importmap_polyfill' => 'es-module-shims',
                 'vendor_dir' => '%kernel.project_dir%/assets/vendor',
                 'importmap_script_attributes' => [],
+                'exclude_dotfiles' => true,
             ],
             'cache' => [
                 'pools' => [],