From 276bfd7fa24a5fe84a6be62cb3ea100beda03369 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Resul=20=C3=96v=C3=BCr?=
 <92828257+ovurrsl@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:58:36 +0300
Subject: [PATCH] fix: file provider rejects document ids with . or .. segments
 (#1016)

---
 .../java/com/droiddeck/launcher/files/AppFilesProvider.kt     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/src/main/java/com/droiddeck/launcher/files/AppFilesProvider.kt b/app/src/main/java/com/droiddeck/launcher/files/AppFilesProvider.kt
index 0f794ce0d..9f534b39b 100644
--- a/app/src/main/java/com/droiddeck/launcher/files/AppFilesProvider.kt
+++ b/app/src/main/java/com/droiddeck/launcher/files/AppFilesProvider.kt
@@ -85,7 +85,7 @@ class AppFilesProvider : DocumentsProvider() {
 
     override fun deleteDocument(documentId: String) {
         val file = fileFor(documentId)
-        if (file.absolutePath == base.absolutePath) throw FileNotFoundException("the app folder itself is not deleted")
+        if (file.canonicalPath == baseCanonical) throw FileNotFoundException("the app folder itself is not deleted")
         try {
             deleteTree(file.toPath())
         } catch (e: IOException) {
@@ -154,7 +154,7 @@ class AppFilesProvider : DocumentsProvider() {
 
     private fun fileFor(documentId: String): File {
         val f = File(documentId)
-        if (!f.isAbsolute || !inside(f)) throw FileNotFoundException("$documentId is outside the app's files")
+        if (!f.isAbsolute || f.normalize().path != documentId || !inside(f)) throw FileNotFoundException("$documentId is outside the app's files")
         if (!f.exists()) throw FileNotFoundException("$documentId not found")
         return f
     }