fix that relatives paths could break out of current directory

vyper/compiler/input_bundle.py

@@ -103,12 +103,14 @@ def _generate_source_id(self, resolved_path: PathLike) -> int:
 
         return self._source_ids[resolved_path]
 
-    def load_file(self, path: PathLike | str) -> CompilerInput:
+    def load_file(self, path: PathLike | str, level: int = 0) -> CompilerInput:
         # search path precedence
         tried = []
+        search_paths = self.search_paths if level == 0 else [self.search_paths[-1]]
+
         if isinstance(path, str):
             path = PurePath(path)
-        for sp in reversed(self.search_paths):
+        for sp in reversed(search_paths):
             # note from pathlib docs:
             # > If the argument is an absolute path, the previous path is ignored.
             # Path("/a") / Path("/b") => Path("/b")

vyper/semantics/analysis/module.py

@@ -817,7 +817,7 @@ def _load_import_helper(
 
         try:
             path_vy = path.with_suffix(".vy")
-            file = self.input_bundle.load_file(path_vy)
+            file = self.input_bundle.load_file(path_vy, level)
             assert isinstance(file, FileInput)  # mypy hint
 
             module_ast = self._ast_from_file(file)
@@ -838,7 +838,7 @@ def _load_import_helper(
             err = e
 
         try:
-            file = self.input_bundle.load_file(path.with_suffix(".vyi"))
+            file = self.input_bundle.load_file(path.with_suffix(".vyi"), level)
             assert isinstance(file, FileInput)  # mypy hint
             module_ast = self._ast_from_file(file)
 
@@ -857,7 +857,7 @@ def _load_import_helper(
             pass
 
         try:
-            file = self.input_bundle.load_file(path.with_suffix(".json"))
+            file = self.input_bundle.load_file(path.with_suffix(".json"), level)
             assert isinstance(file, ABIInput)  # mypy hint
             return file, InterfaceT.from_json_abi(str(file.path), file.abi)
         except FileNotFoundError: