Fix: Add path traversal protection to DirectivePlugin (APSB26-05)

[Maksold]

Summary

Magento 2.4.6-p14 security patch (APSB26-05) added path traversal protection to Magento\Cms\Controller\Adminhtml\Wysiwyg\Directive::execute() via DirectoryResolver::validatePath(). This ensures that only files within the pub/media/ directory can be served.

However, DirectivePlugin::aroundExecute() returns early for SVG/vector images before calling $proceed(), which means the new security validation is completely bypassed for vector image requests.

Security Issue

An admin user could craft a ___directive parameter that resolves to a path outside pub/media/ (e.g., ../../app/etc/env.php). If the file passes isVectorImage() check (extension or MIME type), its contents would be returned via file_get_contents() without any path validation.

Changes

• Add DirectoryResolver to validate that the resolved file path is within the media directory
• Add Filesystem for proper path resolution via getAbsolutePath() (consistent with core Magento approach)
• Normalize path separators (\ → /) before processing
• Replace file_get_contents() with $mediaDirectory->readFile() to use Magento's filesystem abstraction instead of raw PHP file access

Affected Magento Versions

All Magento installations using magestyapps/module-web-images with Magento 2.4.6-p14+ (and likely earlier versions that had less comprehensive but still relevant path handling).

Testing

1. Upload an SVG image via WYSIWYG media gallery → should render correctly (no regression)
2. Attempt to access a file outside pub/media/ via crafted directive → should fail with "Invalid Path" exception and fall through to $proceed()