From 50d5f5143940809ebb5a61e5f507c956c33aa970 Mon Sep 17 00:00:00 2001
From: infi <infi@infi.sh>
Date: Sat, 27 Jun 2026 22:10:54 +0200
Subject: [PATCH] fix(security): CVE-2026-57848

---
 .../stoat/activities/ShareTargetActivity.kt   | 27 ++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/chat/stoat/activities/ShareTargetActivity.kt b/app/src/main/java/chat/stoat/activities/ShareTargetActivity.kt
index c337ba61..f5e39fb1 100644
--- a/app/src/main/java/chat/stoat/activities/ShareTargetActivity.kt
+++ b/app/src/main/java/chat/stoat/activities/ShareTargetActivity.kt
@@ -1,5 +1,7 @@
 package chat.stoat.activities
 
+import android.content.ContentResolver
+import android.content.Context
 import android.content.Intent
 import android.net.Uri
 import android.os.Build
@@ -148,16 +150,39 @@ class ShareTargetActivity : ComponentActivity() {
             }
         }
 
+        val nonNullMedia = media.filterNotNull()
+        val safeMedia = nonNullMedia.filter { isAcceptableShareUri(this, it) }
+        if (nonNullMedia.isNotEmpty() && safeMedia.isEmpty()) {
+            Toast.makeText(
+                this,
+                getString(R.string.share_target_invalid_intent),
+                Toast.LENGTH_SHORT
+            ).show()
+
+            finish()
+            return
+        }
+
         WindowCompat.setDecorFitsSystemWindows(window, false)
 
         setContent {
             ShareTargetScreen(
                 text = text,
-                media = media.filterNotNull(),
+                media = safeMedia,
                 onFinished = { finish() }
             )
         }
     }
+
+    private fun isAcceptableShareUri(context: Context, uri: Uri): Boolean {
+        if (!ContentResolver.SCHEME_CONTENT.equals(uri.scheme, ignoreCase = true)) {
+            return false
+        }
+
+        val authority = uri.authority ?: return false
+        val pkg = context.packageName
+        return authority != pkg && authority != "$pkg.fileprovider"
+    }
 }
 
 class ShareTargetScreenViewModel(