[Android] Prevent file overwrite from external media uri

[Geoffrey Métais]

vlc-android | branch: 3.0.x | Geoffrey Métais <geoffrey.metais at gmail.com> | Thu Mar  1 10:54:45 2018 +0100| [2d603de7ce9244d8d2053716c7db3af90140dfd8] | committer: Geoffrey Métais

Prevent file overwrite from external media uri

Thank to Sergey Toshin for pointing this security flaw

(cherry picked from commit ad0d4c8de2ed5a49197cbb507a7b189b0df1ac53)

> https://code.videolan.org/videolan/vlc-android/commit/2d603de7ce9244d8d2053716c7db3af90140dfd8
---

 vlc-android/src/org/videolan/vlc/util/FileUtils.java | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/vlc-android/src/org/videolan/vlc/util/FileUtils.java b/vlc-android/src/org/videolan/vlc/util/FileUtils.java
index cb53af709..3428d4b6e 100644
--- a/vlc-android/src/org/videolan/vlc/util/FileUtils.java
+++ b/vlc-android/src/org/videolan/vlc/util/FileUtils.java
@@ -360,11 +360,10 @@ public class FileUtils {
                     cursor = ctx.getContentResolver().query(data,
                             new String[]{MediaStore.MediaColumns.DISPLAY_NAME}, null, null, null);
                     if (cursor != null && cursor.moveToFirst()) {
-                        String filename = cursor.getString(cursor.getColumnIndex(MediaStore.MediaColumns.DISPLAY_NAME));
+                        final String filename = cursor.getString(cursor.getColumnIndex(MediaStore.MediaColumns.DISPLAY_NAME)).replace("/", "");
                         Log.i(TAG, "Getting file " + filename + " from content:// URI");
                         is = ctx.getContentResolver().openInputStream(data);
-                        if (is == null)
-                            return data;
+                        if (is == null) return data;
                         os = new FileOutputStream(AndroidDevices.EXTERNAL_PUBLIC_DIRECTORY + "/Download/" + filename);
                         final byte[] buffer = new byte[1024];
                         int bytesRead;