Skip to content

Sanitize BIDI filenames#4015

Merged
mpivchev merged 21 commits intomasterfrom
filename-fixes
Mar 10, 2026
Merged

Sanitize BIDI filenames#4015
mpivchev merged 21 commits intomasterfrom
filename-fixes

Conversation

@mpivchev
Copy link
Collaborator

@mpivchev mpivchev commented Mar 2, 2026

This PR fixes the issue of maliciously spoof naming file names that can trick people into opening a file with a fake extension.

Uses setBidiSafeTitle for nav bars and setBidiSafeFilename for UILabels.

Added 2 UILabels - one for file name and one for extension - in following:

  • NCCreateFormUploadConflictCell
  • NCShareHeader
  • Share/MainInterface.storyboard
  • Share/NCShareCell.swift
  • NCSelect.swift
  • NCViewer.swift
  • NCViewerMedia.swift
  • NCTransfersView.swift
  • FilesWidgetView.swift
  • NCListCell
  • NCGridCell
  • iOSClient/Trash/Cell/NCTrashCellProtocol.swift

Lots of changes here so it's good to put this in Testflight for a while @marinofaggiana

Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
@mpivchev mpivchev changed the title Filename fixes Sanitize BIDI filenames Mar 5, 2026
@mpivchev mpivchev requested a review from marinofaggiana March 5, 2026 10:42
@mpivchev mpivchev marked this pull request as ready for review March 5, 2026 10:42
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
@mpivchev
Copy link
Collaborator Author

mpivchev commented Mar 6, 2026

Added to Testflight

@mpivchev
Copy link
Collaborator Author

mpivchev commented Mar 6, 2026

Also added unit tests

@mpivchev mpivchev enabled auto-merge (squash) March 9, 2026 16:47
…me-fixes

Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
@mpivchev mpivchev disabled auto-merge March 10, 2026 09:38
@mpivchev mpivchev merged commit 950ff4f into master Mar 10, 2026
3 checks passed
@mpivchev mpivchev deleted the filename-fixes branch March 10, 2026 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant