Warnings for dangerous files

js/models/messages.js

@@ -439,10 +439,11 @@
             message: this,
           }),
 
-        onDownload: () =>
+        onDownload: isDangerous =>
           this.trigger('download', {
             attachment: firstAttachment,
             message: this,
+            isDangerous,
           }),
       };
     },

js/modules/types/attachment.js

@@ -108,6 +108,29 @@ exports._replaceUnicodeOrderOverridesSync = attachment => {
 exports.replaceUnicodeOrderOverrides = async attachment =>
   exports._replaceUnicodeOrderOverridesSync(attachment);
 
+// \u202A-\u202E is LRE, RLE, PDF, LRO, RLO
+// \u2066-\u2069 is LRI, RLI, FSI, PDI
+// \u200E is LRM
+// \u200F is RLM
+// \u061C is ALM
+const V2_UNWANTED_UNICODE = /[\u202A-\u202E\u2066-\u2069\u200E\u200F\u061C]/g;
+
+exports.replaceUnicodeV2 = async attachment => {
+  if (!is.string(attachment.fileName)) {
+    return attachment;
+  }
+
+  const fileName = attachment.fileName.replace(
+    V2_UNWANTED_UNICODE,
+    UNICODE_REPLACEMENT_CHARACTER
+  );
+
+  return {
+    ...attachment,
+    fileName,
+  };
+};
+
 exports.removeSchemaVersion = ({ attachment, logger }) => {
   if (!exports.isValid(attachment)) {
     logger.error(

js/modules/types/message.js

@@ -44,6 +44,9 @@ const PRIVATE = 'private';
 // Version 8
 //   - Attachments: Capture video/image dimensions and thumbnails, as well as a
 //       full-size screenshot for video.
+// Version 9
+//   - Attachments: Expand the set of unicode characters we filter out of
+//     attachment filenames
 
 const INITIAL_SCHEMA_VERSION = 0;
 
@@ -270,6 +273,11 @@ const toVersion8 = exports._withSchemaVersion({
   upgrade: exports._mapAttachments(Attachment.captureDimensionsAndScreenshot),
 });
 
+const toVersion9 = exports._withSchemaVersion({
+  schemaVersion: 9,
+  upgrade: exports._mapAttachments(Attachment.replaceUnicodeV2),
+});
+
 const VERSIONS = [
   toVersion0,
   toVersion1,
@@ -280,6 +288,7 @@ const VERSIONS = [
   toVersion6,
   toVersion7,
   toVersion8,
+  toVersion9,
 ];
 exports.CURRENT_SCHEMA_VERSION = VERSIONS.length - 1;
 

js/views/conversation_view.js

@@ -1057,7 +1057,14 @@
       }
     },
 
-    downloadAttachment({ attachment, message }) {
+    downloadAttachment({ attachment, message, isDangerous }) {
+      if (isDangerous) {
+        const toast = new Whisper.DangerousFileTypeToast();
+        toast.$el.appendTo(this.$el);
+        toast.render();
+        return;
+      }
+
       Signal.Types.Attachment.save({
         attachment,
         document,

js/views/file_input_view.js

@@ -34,6 +34,10 @@
     template: i18n('unsupportedFileType'),
   });
 
+  Whisper.DangerousFileTypeToast = Whisper.ToastView.extend({
+    template: i18n('dangerousFileType'),
+  });
+
   Whisper.FileInputView = Backbone.View.extend({
     tagName: 'span',
     className: 'file-input',
@@ -178,6 +182,14 @@
       if (!file) {
         return;
       }
+      const { name } = file;
+      if (window.Signal.Util.isFileDangerous(name)) {
+        const toast = new Whisper.DangerousFileTypeToast();
+        toast.$el.insertAfter(this.$el);
+        toast.render();
+
+        return;
+      }
 
       const contentType = file.type;
 
@@ -297,9 +309,10 @@
 
     getFile(rawFile) {
       const file = rawFile || this.file || this.$input.prop('files')[0];
-      if (file === undefined) {
+      if (!file) {
         return Promise.resolve();
       }
+
       const attachmentFlags = this.isVoiceNote
         ? textsecure.protobuf.AttachmentPointer.Flags.VOICE_MESSAGE
         : null;