fix: path traversal

app/lib/provider/network/server/controller/receive_controller.dart

@@ -447,12 +447,16 @@ class ReceiveController {
     final fileType = receivingFile.file.fileType;
     final saveToGallery = receiveState.saveToGallery && (fileType == FileType.image || fileType == FileType.video);
 
-    final (destinationPath, documentUri, finalName) = await digestFilePathAndPrepareDirectory(
-      parentDirectory: saveToGallery ? receiveState.cacheDirectory : receiveState.destinationDirectory,
-      fileName: receivingFile.desiredName!,
-      createdDirectories: receiveState.createdDirectories,
-    );
+    String? outerDestinationPath;
     try {
+      final (destinationPath, documentUri, finalName) = await digestFilePathAndPrepareDirectory(
+        parentDirectory: saveToGallery ? receiveState.cacheDirectory : receiveState.destinationDirectory,
+        fileName: receivingFile.desiredName!,
+        createdDirectories: receiveState.createdDirectories,
+      );
+
+      outerDestinationPath = destinationPath;
+
       _logger.info('Saving ${receivingFile.file.fileName} to $destinationPath');
 
       await saveFile(
@@ -560,10 +564,10 @@ class ReceiveController {
           Routerino.context.pushRootImmediately(() => const HomePage(initialTab: HomeTab.receive, appStart: false));
 
           // open the dialog to open file instantly
-          if (destinationPath.isNotEmpty) {
+          if (outerDestinationPath != null && outerDestinationPath.isNotEmpty) {
             OpenFileDialog.open(
               Routerino.context, // ignore: use_build_context_synchronously
-              filePath: destinationPath,
+              filePath: outerDestinationPath,
               fileType: fileType,
               openGallery: saveToGallery,
             );

app/lib/util/native/file_saver.dart

@@ -189,10 +189,17 @@ Future<(String, String?, String)> digestFilePathAndPrepareDirectory({
   final fileNameParts = p.split(fileName);
   final dir = p.joinAll([parentDirectory, ...fileNameParts.take(fileNameParts.length - 1)]);
 
-  try {
-    Directory(dir).createSync(recursive: true);
-  } catch (e) {
-    _logger.warning('Could not create directory', e);
+  if (fileNameParts.length > 1) {
+    // Check path traversal
+    if (!p.isWithin(parentDirectory, dir)) {
+      throw 'Path traversal detected';
+    }
+
+    try {
+      Directory(dir).createSync(recursive: true);
+    } catch (e) {
+      _logger.warning('Could not create directory', e);
+    }
   }
 
   String destinationPath;