Firefox · Core
CVE-2024-9395
Logic Error in Core
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.ktmobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
Patch
diff --git a/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt b/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
index ae9d4393a94..192120bd914 100644
--- a/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
+++ b/mobile/android/android-components/components/support/ktx/src/main/java/mozilla/components/support/ktx/kotlin/String.kt
@@ -53,6 +53,8 @@ const val MAX_URI_LENGTH = 25000
private const val FILE_PREFIX = "file://"
private const val MAX_VALID_PORT = 65_535
+private const val SPACE = " "
+private const val UNDERSCORE = "_"
/**
* Shortens URLs to be more user friendly.
@@ -307,7 +309,9 @@ fun String.sanitizeFileName(): String {
file.name.replace("\\.\\.+".toRegex(), ".")
} else {
file.name.replace(".", "")
- }.replaceEscapedCharacters()
+ }.replaceContinuousSpaces()
+ .replaceEscapedCharacters()
+ .trim()
}
/**
@@ -316,7 +320,15 @@ fun String.sanitizeFileName(): String {
*/
private fun String.replaceEscapedCharacters(): String {
val escapedCharactersRegex = "[\\x00-\\x13*\"?<>:|\\\\]".toRegex()
- return replace(escapedCharactersRegex, "_")
+ return replace(escapedCharactersRegex, UNDERSCORE)
+}
+
+/**
+ * Replaces continuous spaces with a single space.
+ */
+private fun String.replaceContinuousSpaces(): String {
+ val escapedCharactersRegex = "\\s+".toRegex()
+ return replace(escapedCharactersRegex, SPACE)
}
/**
diff --git a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
index 12ee4beab6b..51ed86a70f8 100644
--- a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
+++ b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
@@ -199,11 +199,11 @@ class StringTest {
"acknowledge\u0006signal" to "acknowledge_signal",
"bell\u0007sound" to "bell_sound",
"back\u0008space" to "back_space",
- "horizontal\u0009tab" to "horizontal_tab",
- "new\u000Aline" to "new_line",
- "vertical\u000Btab" to "vertical_tab",
- "form\u000Cfeed" to "form_feed",
- "return\u000Dcarriage" to "return_carriage",
+ "horizontal\u0009tab" to "horizontal tab",
+ "new\u000Aline" to "new line",
+ "vertical\u000Btab" to "vertical tab",
+ "form\u000Cfeed" to "form feed",
+ "return\u000Dcarriage" to "return carriage",
"shift\u000Eout" to "shift_out",
"shift\u000Fin" to "shift_in",
"escape\u0010data" to "escape_data",
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
index 12ee4beab6b..51ed86a70f8 100644
--- a/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
+++ b/mobile/android/android-components/components/support/ktx/src/test/java/mozilla/components/support/ktx/kotlin/StringTest.kt
@@ -199,11 +199,11 @@ class StringTest {
"acknowledge\u0006signal" to "acknowledge_signal",
"bell\u0007sound" to "bell_sound",
"back\u0008space" to "back_space",
- "horizontal\u0009tab" to "horizontal_tab",
- "new\u000Aline" to "new_line",
- "vertical\u000Btab" to "vertical_tab",
- "form\u000Cfeed" to "form_feed",
- "return\u000Dcarriage" to "return_carriage",
+ "horizontal\u0009tab" to "horizontal tab",
+ "new\u000Aline" to "new line",
+ "vertical\u000Btab" to "vertical tab",
+ "form\u000Cfeed" to "form feed",
+ "return\u000Dcarriage" to "return carriage",
"shift\u000Eout" to "shift_out",
"shift\u000Fin" to "shift_in",
"escape\u0010data" to "escape_data",
Loading diff…
References
On This Page