Fix/download path validation (#16601)

* fix: validate download destinations and peer filename rules

Reject unsafe or linked download destinations and validate empty-directory
paths before creating them. Bind overwrite approval to accepted transfer
entries and propagate receiver errors to the UI.

Validate remote listings using the peer's filename rules so Unix names
remain browsable on Windows. Reject locally unsafe basenames before
starting downloads from either the Flutter or legacy UI.

Finish the previous file before validating the next digest so rejecting
the next destination preserves the file already received.

Require confirmation before restarting interrupted downloads with stale
staging files. Preserve matching resumes and cover receiver recovery.

Retain explicit overwrite rejection for peers older than 1.1.10 that
cannot negotiate confirmation.

Signed-off-by: fufesou <linlong1266@gmail.com>

* comments

Signed-off-by: fufesou <linlong1266@gmail.com>

* fix: use async I/O for download preparation and resume

Use Tokio filesystem APIs for download setup and resume metadata checks. Run the Windows link-count query on the blocking pool and flush digest writes before returning.

Signed-off-by: fufesou <linlong1266@gmail.com>

---------

Signed-off-by: fufesou <linlong1266@gmail.com>

flutter/lib/models/file_model.dart

@@ -4,6 +4,7 @@ import 'dart:convert';
 import 'package:flutter/material.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/common/widgets/dialog.dart';
+import 'package:flutter_hbb/utils/download_paths.dart';
 import 'package:flutter_hbb/utils/event_loop.dart';
 import 'package:get/get.dart';
 import 'package:path/path.dart' as path;
@@ -627,6 +628,17 @@ class FileController {
     final transferJobIds = <int>[];
     for (var from in items.items) {
       final jobID = jobController.addTransferJob(from, isRemoteToLocal);
+      // Keep this check before PathUtil.join: Rust does not receive the selected
+      // root separately, and Web transfers bypass Rust validation.
+      if (isRemoteToLocal &&
+          !DownloadPaths.validName(from.name, windows: isWindows)) {
+        jobController.jobError({
+          'id': '$jobID',
+          'file_num': '0',
+          'err': 'Invalid file name: ${from.name}',
+        });
+        continue;
+      }
       transferJobs.add((from, jobID));
       transferJobIds.add(jobID);
     }
@@ -651,6 +663,15 @@ class FileController {
       return;
     }
 
+    if (isRemoteToLocal) {
+      for (final (entry, jobID) in transferJobs) {
+        if (entry.isDirectory) {
+          await _downloadEmptyDirectories(entry, jobID, otherSideData);
+        }
+      }
+      return;
+    }
+
     final List<Entry> entrys = items.items.toList();
     var isRemote = isLocal == true ? true : false;
 
@@ -683,6 +704,35 @@ class FileController {
     });
   }
 
+  Future<void> _downloadEmptyDirectories(
+      Entry entry, int jobID, DirectoryData destination) async {
+    try {
+      final emptyDirs = await fileFetcher.readEmptyDirs(
+          entry.path, false, destination.options.showHidden);
+      final localRoot = PathUtil.join(destination.directory.path, entry.name,
+          destination.options.isWindows);
+      final paths = emptyDirs
+          .map((dir) => DownloadPaths.mapDirectory(
+              entry.path, dir.path, localRoot,
+              remoteWindows: options.value.isWindows,
+              localWindows: destination.options.isWindows))
+          .toList();
+      for (final path in paths) {
+        await DownloadPaths.ensureNoLinks(destination.directory.path, path);
+      }
+      for (final path in paths) {
+        await createDirWithRemote(path, false);
+      }
+    } on FormatException catch (err) {
+      await bind.sessionCancelJob(sessionId: sessionId, actId: jobID);
+      jobController.jobError({
+        'id': '$jobID',
+        'file_num': '0',
+        'err': err.message,
+      });
+    }
+  }
+
   bool _removeCheckboxRemember = false;
 
   Future<void> removeAction(SelectedItems items) async {
@@ -1120,6 +1170,11 @@ class JobController {
       return true;
     }
     final job = jobTable[jobIndex];
+    if (job.type == JobType.transfer &&
+        job.isRemoteToLocal &&
+        job.state == JobState.error) {
+      return true;
+    }
     job.recvJobRes = true;
     if (job.type == JobType.deleteFile) {
       job.state = JobState.done;

flutter/lib/utils/download_paths.dart

@@ -0,0 +1,52 @@
+import 'dart:io';
+
+import 'package:path/path.dart' as path;
+
+class DownloadPaths {
+  static Future<void> ensureNoLinks(String root, String destination) async {
+    if (!path.isWithin(root, destination)) {
+      throw FormatException('Invalid download directory: $destination');
+    }
+    var current = root;
+    for (final name in path.split(path.relative(destination, from: root))) {
+      current = path.join(current, name);
+      if (await FileSystemEntity.type(current, followLinks: false) ==
+          FileSystemEntityType.link) {
+        throw FormatException('Download directory contains a link: $current');
+      }
+    }
+  }
+
+  static bool validName(String name, {required bool windows}) {
+    if (name.isEmpty || name == '.' || name == '..' || name.contains('\x00')) {
+      return false;
+    }
+    if (name.contains('/')) return false;
+    return !windows ||
+        (!name.contains(RegExp(r'[<>:"\\|?*]')) &&
+            !name.endsWith('.') &&
+            !name.endsWith(' '));
+  }
+
+  static String mapDirectory(
+      String remoteRoot, String remotePath, String localRoot,
+      {required bool remoteWindows, required bool localWindows}) {
+    final remote = path.Context(
+        style: remoteWindows ? path.Style.windows : path.Style.posix);
+    final local = path.Context(
+        style: localWindows ? path.Style.windows : path.Style.posix);
+    if (remotePath.contains('\x00') ||
+        remote.split(remotePath).contains('..') ||
+        (!remote.equals(remoteRoot, remotePath) &&
+            !remote.isWithin(remoteRoot, remotePath))) {
+      throw FormatException('Invalid download directory: $remotePath');
+    }
+    final relative = remote.relative(remotePath, from: remoteRoot);
+    if (relative == '.') return localRoot;
+    final names = remote.split(relative);
+    if (names.any((name) => !validName(name, windows: localWindows))) {
+      throw FormatException('Invalid download directory: $remotePath');
+    }
+    return local.joinAll([localRoot, ...names]);
+  }
+}