From a6afd7141e02d9dfa0c25849ff758707879b61f7 Mon Sep 17 00:00:00 2001
From: Dibyajyoti Pal <[email protected]>
Date: Tue, 12 May 2026 09:23:54 -0700
Subject: [PATCH] [WebShare] Enforce SafeBaseName validations in Java

The Android WebShare API receives file sharing requests from renderer
processes. SharedFile objects use the mojo_base.mojom.SafeBaseName type
for filenames. In C++, SafeBaseName traits validate that filenames do
not contain directory separators or traversal components. However, on
Android, Mojo IPCs are forwarded directly to Java, bypassing C++ traits.

To prevent compromised renderers from attempting path traversal attacks,
this change updates ShareServiceImpl.isDangerousFilename to explicitly
reject filenames containing directory separators or traversal
components. Also includes tests for this change.

Fixed: 511741173
Change-Id: I65a96cbf966cd0284b063d18283483d8dd300ba5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7837663
Reviewed-by: Kunjan Patel <[email protected]>
Commit-Queue: Dibyajyoti Pal <[email protected]>
Reviewed-by: Adriana Ixba <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629383}
---

diff --git a/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImpl.java b/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImpl.java
index b45a3a3..dcb6a08 100644
--- a/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImpl.java
+++ b/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImpl.java
@@ -308,10 +308,42 @@
         }.executeOnTaskRunner(TASK_RUNNER);
     }
 
+    // This function mimics the checks created by `SafeBaseName::Create()` as much as possible.
     static boolean isDangerousFilename(String name) {
-        // Reject filenames without a permitted extension.
-        return name.indexOf('.') <= 0
-                || !PERMITTED_EXTENSIONS.contains(FileUtils.getExtension(name));
+        // Empty name, invalid.
+        if (name == null || name.isEmpty()) {
+            return true;
+        }
+
+        // 1. Check for directory traversal components ".."
+        if (name.contains("..") || name.equals(".")) {
+            return true;
+        }
+
+        // 2. Check for directory separators '/' or '\\', as a `SafeBaseName` shouldn't have those.
+        if (name.contains("/") || name.contains("\\")) {
+            return true;
+        }
+
+        // 3. Check for leading/trailing spaces or dots that can be problematic.
+        String trimmedName = name.trim();
+        if (!name.equals(trimmedName) || trimmedName.endsWith(".")) {
+            return true;
+        }
+
+        // 4. Original extension check: Reject filenames without a permitted extension.
+        int dotIndex = trimmedName.lastIndexOf('.');
+        if (dotIndex <= 0) {
+            return true;
+        }
+
+        String extension = FileUtils.getExtension(trimmedName);
+        if (!PERMITTED_EXTENSIONS.contains(extension)) {
+            return true;
+        }
+
+        // If the above validation passed, the file is safe to be shared.
+        return false;
     }
 
     static boolean isDangerousMimeType(String contentType) {
diff --git a/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImplTest.java b/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImplTest.java
index 5371021..5c23846 100644
--- a/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImplTest.java
+++ b/components/browser_ui/webshare/android/java/src/org/chromium/components/browser_ui/webshare/ShareServiceImplTest.java
@@ -17,22 +17,36 @@
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(manifest = Config.NONE)
 public class ShareServiceImplTest {
+    // Verifies all the file names that are not allowed to be shared on Android.
     @Test
     @SmallTest
-    public void testExtensionFormatting() {
-        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("foo/bar.txt"));
-        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("foo\\bar\u03C0.txt"));
+    public void testExtensionFormattingDisallowed() {
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("foo/bar.txt"));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("foo\\bar\u03C0.txt"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename("foo\\bar.tx\u03C0t"));
-        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("https://example.com/a/b.html"));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("https://example.com/a/b.html"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename("foo/bar.txt/"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename("foobar.tx\\t"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename("hello"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename("hellotxt"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename(".txt"));
-        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("https://example.com/a/.txt"));
-        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("/.txt"));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("https://example.com/a/.txt"));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("/.txt"));
         Assert.assertTrue(ShareServiceImpl.isDangerousFilename(".."));
-        Assert.assertTrue(ShareServiceImpl.isDangerousFilename(".hello.txt"));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("bar.tx\u03C0t"));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename("."));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename(" my_name "));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename(" . "));
+        Assert.assertTrue(ShareServiceImpl.isDangerousFilename(".config"));
+    }
+
+    // Verifies all the file names that are allowed to be shared on Android.
+    @Test
+    @SmallTest
+    public void testExtensionFormattingAllowed() {
+        Assert.assertFalse(ShareServiceImpl.isDangerousFilename(".hello.txt"));
+        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("bar.txt"));
+        Assert.assertFalse(ShareServiceImpl.isDangerousFilename("bar\u03C0.txt"));
     }
 
     @Test