android: prevent imported archive from being written outside the export folder (#7375)

apps/multiplatform/common/src/androidMain/kotlin/chat/simplex/common/views/helpers/Utils.android.kt

@@ -233,7 +233,8 @@ actual fun getFileName(uri: URI): String? {
       val nameIndex = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME)
       cursor.moveToFirst()
       // Can make an exception
-      cursor.getString(nameIndex)
+      // the provider controls this value, and callers use it as a bare file name
+      cursor.getString(nameIndex)?.let { File(it).name }
     }
   } catch (e: Exception) {
     null

apps/multiplatform/common/src/commonMain/kotlin/chat/simplex/common/views/database/DatabaseView.kt

@@ -753,6 +753,11 @@ private fun saveArchiveFromURI(importedArchiveURI: URI): String? {
     if (inputStream != null && archiveName != null) {
       val archivePath = "$databaseExportDir${File.separator}$archiveName"
       val destFile = File(archivePath)
+      // resolves symlinks, so it also catches a final component linking outside the folder
+      if (destFile.canonicalFile.parentFile != databaseExportDir.canonicalFile) {
+        Log.e(TAG, "saveArchiveFromURI path outside of export folder")
+        return null
+      }
       Files.copy(inputStream, destFile.toPath(), StandardCopyOption.REPLACE_EXISTING)
       archivePath
     } else {