Fix MakeViewVariableOptionalSolution to disallow stream wrappers and files that do not end in .blade.php

[cfreal]

Hello, as discussed by email, this fixes a serious vulnerability.
Hopefully my code is OK-ish.

[freekmurze]

Thanks!

[abergmann]

CVE-2021-3129 was assigned to this PR.

[jplana-ubc]

Can we get this patch committed to the 1.16.x branch?

[jplana-ubc]

I would love to create a PR myself with the changes for the 1.16.4 release, but unfortunately everything lives in the same branch (both 2.x and 1.x versions of this package).

It would be fantastic if there was a way to push these changes to a 1.16.5 tag, so all the folks still using Laravel 6 and facade/ignition 1.x could benefit of this change.

diff --git a/src/Solutions/MakeViewVariableOptionalSolution.php b/src/Solutions/MakeViewVariableOptionalSolution.php
index 2903414..7e53117 100644
--- a/src/Solutions/MakeViewVariableOptionalSolution.php
+++ b/src/Solutions/MakeViewVariableOptionalSolution.php
@@ -4,6 +4,7 @@ namespace Facade\Ignition\Solutions;

 use Facade\IgnitionContracts\RunnableSolution;
 use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Str;

 class MakeViewVariableOptionalSolution implements RunnableSolution
 {
@@ -71,8 +72,24 @@ class MakeViewVariableOptionalSolution implements RunnableSolution
         }
     }

+    protected function isSafePath(string $path): bool
+    {
+        if (!Str::startsWith($path, ['/', './'])) {
+            return false;
+        }
+        if (!Str::endsWith($path, '.blade.php')) {
+            return false;
+        }
+
+        return true;
+    }
+
     public function makeOptional(array $parameters = [])
     {
+        if (!$this->isSafePath($parameters['viewFile'])) {
+            return false;
+        }
+
         $originalContents = file_get_contents($parameters['viewFile']);
         $newContents = str_replace('$'.$parameters['variableName'], '$'.$parameters['variableName']." ?? ''", $originalContents);