What causes "Importing "%s" is not allowed." in flarum/framework?

Change the @import to a relative path that resolves inside the allowed import root (the extension/theme's LESS directory).

flarum/framework · error · Less_Exception_Parser

Importing " " is not allowed.

Error message

Importing "%s" is not allowed.

What it means

LessCompiler::containImports throws Less_Exception_Parser with 'Importing "%s" is not allowed.' when compiled LESS contains an @import whose resolved path escapes the permitted import root directory. Flarum sandboxes LESS imports to prevent arbitrary file reads during stylesheet compilation.

Solutions

Change the @import to a relative path that resolves inside the allowed import root (the extension/theme's LESS directory).
Copy the imported file into the compiling package's directory and import it by filename.
Remove the @import and inline the needed variables/mixins, or have the extension register the LESS as a separate asset instead.

Example fix

// before
@import "../../../../core/less/variables.less";

// after: copy variables.less next to this file
@import "variables.less";

Defensive patterns

Strategy: validation

Validate before calling

// before shipping LESS, verify imports resolve inside the package
foreach (extractImports($less) as $path) {
  $resolved = realpath(dirname($lessFile) . '/' . $path);
  if ($resolved === false || !str_starts_with($resolved, $importRoot . DIRECTORY_SEPARATOR)) {
    throw new RuntimeException("Import escapes root: $path");
  }
}

Try / catch

try {
    $assets->makeCss()->commit();
} catch (Less_Exception_Parser $e) {
    // check the import path named in the message and fix it
}

Prevention

Use relative imports that stay within the theme/extension's LESS directory.
Never use absolute paths or ../ traversal in shipped LESS.
Compile assets in CI so bad imports are caught before deployment.
Inline shared variables instead of cross-package imports.

When it happens

Trigger: A theme or extension LESS file contains @import with an absolute path, ../ traversal out of the allowed directory, or a path that cannot be resolved inside the root; triggered during frontend asset compilation (compile).

Common situations: Themes ported from standalone LESS projects importing external files; extensions shipping LESS with @import '../../shared/variables.less' after directory restructuring; custom styles attempting to import system files (blocked as a security measure).

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of flarum/framework@4b939f6853 (2026-09-15). Data as JSON: /api/errors/b1262ca7905c9d7c. Report an issue: GitHub.

Appendix: source

Thrown at framework/core/src/Frontend/Compiler/LessCompiler.php:121

                continue;
            }

            $root = realpath($dir);

            if ($root === false) {
                continue;
            }

            $resolved = realpath($root.'/'.ltrim($path, '/\\'));

            // realpath() has followed `..` and any symlink, so a path that
            // still starts with the directory really is inside it.
            if ($resolved !== false && str_starts_with($resolved, $root.DIRECTORY_SEPARATOR)) {
                return [$resolved, null];
            }
        }

        throw new Less_Exception_Parser(
            sprintf('Importing "%s" is not allowed.', $path)
        );
    }

    /**
     * @throws \Less_Exception_Parser
     */
    protected function compile(array $sources): string
    {
        if (! count($sources)) {
            return '';
        }

        if (! empty($this->settings->get('custom_less_error'))) {
            unset($sources['custom_less']);
        }

        $maxNestingLevel = ini_get('xdebug.max_nesting_level');

View on GitHub (pinned to 4b939f6853)