We cannot use relative URIs to reference files outside of a package.

pkg/analysis_server/lib/src/services/correction/fix_internal.dart

Index: pkg/analysis_server/lib/src/services/correction/fix_internal.dart
diff --git a/pkg/analysis_server/lib/src/services/correction/fix_internal.dart b/pkg/analysis_server/lib/src/services/correction/fix_internal.dart
index 4f31c58f198444444820ee3f29a59d71f80055db..151201ba4d413f2189fbd313d91316d379ec646e 100644
--- a/pkg/analysis_server/lib/src/services/correction/fix_internal.dart
+++ b/pkg/analysis_server/lib/src/services/correction/fix_internal.dart
@@ -103,8 +103,8 @@ class FixProcessor {
   CompilationUnitElement unitElement;
   Source unitSource;
   LibraryElement unitLibraryElement;
-  String unitLibraryFile;
-  String unitLibraryFolder;
+  File unitLibraryFile;
+  Folder unitLibraryFolder;
 
   final List<Fix> fixes = <Fix>[];
 
@@ -136,8 +136,9 @@ class FixProcessor {
     fileStamp = context.getModificationStamp(unitSource);
     // library
     unitLibraryElement = unitElement.library;
-    unitLibraryFile = unitLibraryElement.source.fullName;
-    unitLibraryFolder = dirname(unitLibraryFile);
+    String unitLibraryPath = unitLibraryElement.source.fullName;
+    unitLibraryFile = resourceProvider.getFile(unitLibraryPath);
+    unitLibraryFolder = unitLibraryFile.parent;
     // error
     error = dartContext.error;
   }
@@ -1634,6 +1635,9 @@ class FixProcessor {
         if (alreadyImportedWithPrefix.contains(librarySource)) {
           continue;
         }
+        if (!_isSourceVisibleToLibrary(librarySource)) {
+          continue;
+        }
         // Compute the fix kind.
         FixKind fixKind;
         if (librarySource.isInSystemLibrary) {
@@ -2900,6 +2904,36 @@ class FixProcessor {
   }
 
   /**
+   * Return `true` if the [source] can be imported into [unitLibraryFile].
+   */
+  bool _isSourceVisibleToLibrary(Source source) {
+    if (!source.uri.isScheme('file')) {
+      return true;
+    }
+
+    // Prepare the root of our package.
+    Folder packageRoot;
+    for (Folder folder = unitLibraryFolder;
+        folder != null;
+        folder = folder.parent) {
+      if (folder.getChildAssumingFile('pubspec.yaml').exists ||
+          folder.getChildAssumingFile('BUILD').exists) {
+        packageRoot = folder;
+        break;
+      }
+    }
+
+    // This should be rare / never situation.
+    if (packageRoot == null) {
+      return true;
+    }
+
+    // We cannot use relative URIs to reference files outside of our package.
+    return resourceProvider.pathContext
+        .isWithin(packageRoot.path, source.fullName);
+  }
+
+  /**
    * Removes any [ParenthesizedExpression] enclosing [expr].
    *
    * [exprPrecedence] - the effective precedence of [expr].