symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest

An attacker who controls a recipe kit (e.g., via a compromised dependency or social engineering) crafts a `copy-files` entry with a destination path containing `..` segments, such as `../../../../tmp/PWNED`. The `ux:install` command's only guard, `Path::isRelative()`, passes this path because it is technically relative. `Path::join()` then resolves the `..` segments, allowing the copy operation to write attacker-controlled content to an arbitrary location on the developer's machine or CI runner. Because the copy creates missing parent directories and can overwrite existing files silently (with `--force` or in non-interactive environments), the attacker can overwrite files like controllers, git hooks, or `.env` to achieve code execution. The source side of `copy-files` is symmetrically affected, enabling local file reads outside the recipe directory. [ref_id=1]

The vulnerability resides in the `ux:install` console command, specifically in the `RecipeManifest` and `File` classes of the Symfony UX Toolkit. The `copy-files` map in a recipe manifest was only guarded by `Path::isRelative()`, which returns `true` for paths like `../../../etc`, allowing `Path::join()` to resolve `..` segments and escape the intended directory. The `Installer::handlePool()` method then performed the filesystem operations without verifying the resolved paths stayed within the base directory. [patch_id=6640819]

The fix introduces `Assert::pathDoesNotEscapeDirectory()`, a helper that splits the path on `/` or `\)` separators and rejects any path containing a literal `..` segment. This check is enforced in `RecipeManifest` (which validates the `copy-files` map when the recipe is loaded) and in `File` (which validates each source/destination pair at construction time). As a last line of defense, the `Installer::handlePool()` method re-verifies the fully resolved absolute paths with `Path::isBasePath()` immediately before each filesystem read and write, ensuring the copy can never land outside its base directory. [patch_id=6640819]