From 62e1003f104076b211327ab9211b3b46a8fdd2fc Mon Sep 17 00:00:00 2001
From: Elias Nahum <nahumhbl@gmail.com>
Date: Tue, 9 Mar 2021 11:53:53 -0300
Subject: [PATCH] [V2] MM-33495 Sanitize filename in Android ShareExtension
 (#5211)

* [V2] MM-33495 Sanitize filename in Android ShareExtension

* Apply sanitization after getting uri last path segment
---
 .../com/mattermost/helpers/RealPathUtil.java  | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/android/app/src/main/java/com/mattermost/helpers/RealPathUtil.java b/android/app/src/main/java/com/mattermost/helpers/RealPathUtil.java
index 262b2ae4c..a34bf3abb 100644
--- a/android/app/src/main/java/com/mattermost/helpers/RealPathUtil.java
+++ b/android/app/src/main/java/com/mattermost/helpers/RealPathUtil.java
@@ -97,20 +97,24 @@ public class RealPathUtil {
         File tmpFile;
         String fileName = null;
 
+        if (uri == null || uri.isRelative()) {
+            return null;
+        }
+
         // Try and get the filename from the Uri
         try {
             Cursor returnCursor =
                     context.getContentResolver().query(uri, null, null, null, null);
             int nameIndex = returnCursor.getColumnIndex(OpenableColumns.DISPLAY_NAME);
             returnCursor.moveToFirst();
-            fileName = returnCursor.getString(nameIndex);
+            fileName = sanitizeFilename(returnCursor.getString(nameIndex));
         } catch (Exception e) {
             // just continue to get the filename with the last segment of the path
         }
 
         try {
-            if (fileName == null) {
-                fileName = uri.getLastPathSegment().toString().trim();
+            if (TextUtils.isEmpty(fileName)) {
+                fileName = sanitizeFilename(uri.getLastPathSegment().toString().trim());
             }
 
 
@@ -231,4 +235,14 @@ public class RealPathUtil {
 
         fileOrDirectory.delete();
     }
+
+    private static String sanitizeFilename(String filename) {
+        if (filename == null) {
+            return null;
+        }
+
+        File f = new File(filename);
+        return f.getName();
+    }
+
 }