Skip to content

Sanitize BIDI filenames#4015

Open
mpivchev wants to merge 20 commits intomasterfrom
filename-fixes
Open

Sanitize BIDI filenames#4015
mpivchev wants to merge 20 commits intomasterfrom
filename-fixes

Conversation

@mpivchev
Copy link
Collaborator

@mpivchev mpivchev commented Mar 2, 2026

Resolves: https://github.com/nextcloud-gmbh/h1/issues/453

This PR fixes the issue of maliciously spoof naming file names that can trick people into opening a file with a fake extension.

Uses setBidiSafeTitle for nav bars and setBidiSafeFilename for UILabels.

Added 2 UILabels - one for file name and one for extension - in following:

  • NCCreateFormUploadConflictCell
  • NCShareHeader
  • Share/MainInterface.storyboard
  • Share/NCShareCell.swift
  • NCSelect.swift
  • NCViewer.swift
  • NCViewerMedia.swift
  • NCTransfersView.swift
  • FilesWidgetView.swift
  • NCListCell
  • NCGridCell
  • iOSClient/Trash/Cell/NCTrashCellProtocol.swift

Lots of changes here so it's good to put this in Testflight for a while @marinofaggiana

Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
@mpivchev mpivchev changed the title Filename fixes Sanitize BIDI filenames Mar 5, 2026
@mpivchev mpivchev requested a review from marinofaggiana March 5, 2026 10:42
@mpivchev mpivchev marked this pull request as ready for review March 5, 2026 10:42
Signed-off-by: Milen Pivchev <milen.pivchev@gmail.com>
@mpivchev
Copy link
Collaborator Author

mpivchev commented Mar 6, 2026

Added to Testflight

@mpivchev
Copy link
Collaborator Author

mpivchev commented Mar 6, 2026

Also added unit tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant