From 0764e4396411995329464d5325e10d08f6fde45e Mon Sep 17 00:00:00 2001
From: M66B <M66B@users.noreply.github.com>
Date: Tue, 19 Feb 2019 14:46:20 +0000
Subject: [PATCH] Sanitize attachment filenames

---
 app/src/main/java/eu/faircode/email/AdapterAttachment.java | 4 ++--
 app/src/main/java/eu/faircode/email/Helper.java            | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/src/main/java/eu/faircode/email/AdapterAttachment.java b/app/src/main/java/eu/faircode/email/AdapterAttachment.java
index 056d6fa817..737a56ff4b 100644
--- a/app/src/main/java/eu/faircode/email/AdapterAttachment.java
+++ b/app/src/main/java/eu/faircode/email/AdapterAttachment.java
@@ -188,7 +188,7 @@ public class AdapterAttachment extends RecyclerView.Adapter<AdapterAttachment.Vi
             lbm.sendBroadcast(
                     new Intent(ActivityView.ACTION_STORE_ATTACHMENT)
                             .putExtra("id", attachment.id)
-                            .putExtra("name", attachment.name)
+                            .putExtra("name", Helper.sanitizeFilename(attachment.name))
                             .putExtra("type", attachment.type));
         }
 
@@ -205,7 +205,7 @@ public class AdapterAttachment extends RecyclerView.Adapter<AdapterAttachment.Vi
             intent.setDataAndType(uri, attachment.type);
             intent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
             if (!TextUtils.isEmpty(attachment.name))
-                intent.putExtra(Intent.EXTRA_TITLE, attachment.name);
+                intent.putExtra(Intent.EXTRA_TITLE, Helper.sanitizeFilename(attachment.name));
             Log.i("Sharing " + file + " type=" + attachment.type);
             Log.i("Intent=" + intent);
 
diff --git a/app/src/main/java/eu/faircode/email/Helper.java b/app/src/main/java/eu/faircode/email/Helper.java
index a11c02dfa1..df9435414c 100644
--- a/app/src/main/java/eu/faircode/email/Helper.java
+++ b/app/src/main/java/eu/faircode/email/Helper.java
@@ -1001,4 +1001,8 @@ public class Helper {
         }
         return sb.toString();
     }
+
+    static String sanitizeFilename(String name) {
+        return (name == null ? null : name.replaceAll("[^a-zA-Z0-9\\.\\-]", "_"));
+    }
 }