Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionA specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog.<br>*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*
ComponentCore
Bug ClassLogic Error
Tracker1906024
Fix commitaeb8e9b29d78 (firefox) +19/-7
CISA KEVNot listed
CreditedHafiizh
Disclosed2024-10-01

Files Changed

  • mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
  • mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
diff --git a/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt b/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
index ae9d4393a94..192120bd914 100644
--- a/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
+++ b/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
@@ -53,6 +53,8 @@ const val MAX_URI_LENGTH = 25000
 
 private const val FILE_PREFIX = "file://"
 private const val MAX_VALID_PORT = 65_535
+private const val SPACE = " "
+private const val UNDERSCORE = "_"
 
 /**
  * Shortens URLs to be more user friendly.
@@ -307,7 +309,9 @@ fun String.sanitizeFileName(): String {
         file.name.replace("\\.\\.+".toRegex(), ".")
     } else {
         file.name.replace(".", "")
-    }.replaceEscapedCharacters()
+    }.replaceContinuousSpaces()
+        .replaceEscapedCharacters()
+        .trim()
 }
 
 /**
@@ -316,7 +320,15 @@ fun String.sanitizeFileName(): String {
  */
 private fun String.replaceEscapedCharacters(): String {
     val escapedCharactersRegex = "[\\x00-\\x13*\"?<>:|\\\\]".toRegex()
-    return replace(escapedCharactersRegex, "_")
+    return replace(escapedCharactersRegex, UNDERSCORE)
+}
+
+/**
+ * Replaces continuous spaces with a single space.
+ */
+private fun String.replaceContinuousSpaces(): String {
+    val escapedCharactersRegex = "\\s+".toRegex()
+    return replace(escapedCharactersRegex, SPACE)
 }
 
 /**
diff --git a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
index 12ee4beab6b..51ed86a70f8 100644
--- a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
+++ b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
@@ -199,11 +199,11 @@ class StringTest {
             "acknowledge\u0006signal" to "acknowledge_signal",
             "bell\u0007sound" to "bell_sound",
             "back\u0008space" to "back_space",
-            "horizontal\u0009tab" to "horizontal_tab",
-            "new\u000Aline" to "new_line",
-            "vertical\u000Btab" to "vertical_tab",
-            "form\u000Cfeed" to "form_feed",
-            "return\u000Dcarriage" to "return_carriage",
+            "horizontal\u0009tab" to "horizontal tab",
+            "new\u000Aline" to "new line",
+            "vertical\u000Btab" to "vertical tab",
+            "form\u000Cfeed" to "form feed",
+            "return\u000Dcarriage" to "return carriage",
             "shift\u000Eout" to "shift_out",
             "shift\u000Fin" to "shift_in",
             "escape\u0010data" to "escape_data",
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
index 12ee4beab6b..51ed86a70f8 100644
--- a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
+++ b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
@@ -199,11 +199,11 @@ class StringTest {
             "acknowledge\u0006signal" to "acknowledge_signal",
             "bell\u0007sound" to "bell_sound",
             "back\u0008space" to "back_space",
-            "horizontal\u0009tab" to "horizontal_tab",
-            "new\u000Aline" to "new_line",
-            "vertical\u000Btab" to "vertical_tab",
-            "form\u000Cfeed" to "form_feed",
-            "return\u000Dcarriage" to "return_carriage",
+            "horizontal\u0009tab" to "horizontal tab",
+            "new\u000Aline" to "new line",
+            "vertical\u000Btab" to "vertical tab",
+            "form\u000Cfeed" to "form feed",
+            "return\u000Dcarriage" to "return carriage",
             "shift\u000Eout" to "shift_out",
             "shift\u000Fin" to "shift_in",
             "escape\u0010data" to "escape_data",
Loading diff…