Fix/download path validation (#16601)

* fix: validate download destinations and peer filename rules

Reject unsafe or linked download destinations and validate empty-directory
paths before creating them. Bind overwrite approval to accepted transfer
entries and propagate receiver errors to the UI.

Validate remote listings using the peer's filename rules so Unix names
remain browsable on Windows. Reject locally unsafe basenames before
starting downloads from either the Flutter or legacy UI.

Finish the previous file before validating the next digest so rejecting
the next destination preserves the file already received.

Require confirmation before restarting interrupted downloads with stale
staging files. Preserve matching resumes and cover receiver recovery.

Retain explicit overwrite rejection for peers older than 1.1.10 that
cannot negotiate confirmation.

Signed-off-by: fufesou <linlong1266@gmail.com>

* comments

Signed-off-by: fufesou <linlong1266@gmail.com>

* fix: use async I/O for download preparation and resume

Use Tokio filesystem APIs for download setup and resume metadata checks. Run the Windows link-count query on the blocking pool and flush digest writes before returning.

Signed-off-by: fufesou <linlong1266@gmail.com>

---------

Signed-off-by: fufesou <linlong1266@gmail.com>

flutter/lib/models/file_model.dart

@@ -4,6 +4,7 @@ import 'dart:convert';
 import 'package:flutter/material.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/common/widgets/dialog.dart';
+import 'package:flutter_hbb/utils/download_paths.dart';
 import 'package:flutter_hbb/utils/event_loop.dart';
 import 'package:get/get.dart';
 import 'package:path/path.dart' as path;
@@ -627,6 +628,17 @@ class FileController {
     final transferJobIds = <int>[];
     for (var from in items.items) {
       final jobID = jobController.addTransferJob(from, isRemoteToLocal);
+      // Keep this check before PathUtil.join: Rust does not receive the selected
+      // root separately, and Web transfers bypass Rust validation.
+      if (isRemoteToLocal &&
+          !DownloadPaths.validName(from.name, windows: isWindows)) {
+        jobController.jobError({
+          'id': '$jobID',
+          'file_num': '0',
+          'err': 'Invalid file name: ${from.name}',
+        });
+        continue;
+      }
       transferJobs.add((from, jobID));
       transferJobIds.add(jobID);
     }
@@ -651,6 +663,15 @@ class FileController {
       return;
     }
 
+    if (isRemoteToLocal) {
+      for (final (entry, jobID) in transferJobs) {
+        if (entry.isDirectory) {
+          await _downloadEmptyDirectories(entry, jobID, otherSideData);
+        }
+      }
+      return;
+    }
+
     final List<Entry> entrys = items.items.toList();
     var isRemote = isLocal == true ? true : false;
 
@@ -683,6 +704,35 @@ class FileController {
     });
   }
 
+  Future<void> _downloadEmptyDirectories(
+      Entry entry, int jobID, DirectoryData destination) async {
+    try {
+      final emptyDirs = await fileFetcher.readEmptyDirs(
+          entry.path, false, destination.options.showHidden);
+      final localRoot = PathUtil.join(destination.directory.path, entry.name,
+          destination.options.isWindows);
+      final paths = emptyDirs
+          .map((dir) => DownloadPaths.mapDirectory(
+              entry.path, dir.path, localRoot,
+              remoteWindows: options.value.isWindows,
+              localWindows: destination.options.isWindows))
+          .toList();
+      for (final path in paths) {
+        await DownloadPaths.ensureNoLinks(destination.directory.path, path);
+      }
+      for (final path in paths) {
+        await createDirWithRemote(path, false);
+      }
+    } on FormatException catch (err) {
+      await bind.sessionCancelJob(sessionId: sessionId, actId: jobID);
+      jobController.jobError({
+        'id': '$jobID',
+        'file_num': '0',
+        'err': err.message,
+      });
+    }
+  }
+
   bool _removeCheckboxRemember = false;
 
   Future<void> removeAction(SelectedItems items) async {
@@ -1120,6 +1170,11 @@ class JobController {
       return true;
     }
     final job = jobTable[jobIndex];
+    if (job.type == JobType.transfer &&
+        job.isRemoteToLocal &&
+        job.state == JobState.error) {
+      return true;
+    }
     job.recvJobRes = true;
     if (job.type == JobType.deleteFile) {
       job.state = JobState.done;