Append theme's sass path after all sanitizations (#96)

Merge pull request 96

.travis.yml

@@ -3,13 +3,9 @@ language: ruby
 rvm:
   - &latest_ruby 2.6
   - 2.4
-matrix:
-  include:
-    - rvm: *latest_ruby
-      env: JEKYLL_VERSION=3.8.6
 env:
   matrix:
-    - JEKYLL_VERSION=4.0.0.pre.alpha1
+    - JEKYLL_VERSION=4.0
 branches:
   only:
     - master

Gemfile

@@ -4,3 +4,4 @@ source "https://rubygems.org"
 gemspec
 
 gem "jekyll", ENV["JEKYLL_VERSION"] ? "~> #{ENV["JEKYLL_VERSION"]}" : ">= 3.0"
+gem "minima"

lib/jekyll/converters/scss.rb

@@ -129,7 +129,6 @@ def sass_dir_relative_to_site_source
       # rubocop:disable Metrics/AbcSize
       def sass_load_paths
         paths = user_sass_load_paths + [sass_dir_relative_to_site_source]
-        paths << site.theme.sass_path if site.theme&.sass_path
 
         if safe?
           # Sanitize paths to prevent any attack vectors (.e.g. `/**/*`)
@@ -150,6 +149,7 @@ def sass_load_paths
           end
         end
 
+        paths << site.theme.sass_path if site.theme&.sass_path
         paths.select { |path| File.directory?(path) }
       end
       # rubocop:enable Metrics/AbcSize

spec/scss_converter_spec.rb

@@ -302,6 +302,38 @@ def converter(overrides = {})
     end
   end
 
+  context "with valid sass paths in a theme" do
+    context "in unsafe mode" do
+      let(:site) do
+        Jekyll::Site.new(
+          site_configuration.merge("theme" => "minima")
+        )
+      end
+
+      it "includes the theme's sass directory" do
+        expect(site.theme.sass_path).to be_truthy
+        expect(converter.sass_load_paths).to include(site.theme.sass_path)
+      end
+    end
+
+    context "in safe mode" do
+      let(:site) do
+        Jekyll::Site.new(
+          site_configuration.merge(
+            "theme" => "minima",
+            "safe"  => true
+          )
+        )
+      end
+
+      it "includes the theme's sass directory" do
+        expect(site.safe).to be true
+        expect(site.theme.sass_path).to be_truthy
+        expect(converter.sass_load_paths).to include(site.theme.sass_path)
+      end
+    end
+  end
+
   context "in a site with a collection labelled 'pages'" do
     let(:site) do
       make_site(