Get the latest tech news
Improperly trusting ContentProvider-provided filename
OWASP category: MASVS-CODE: Code Quality Overview FileProvider, a subclass of ContentProvider, is intended to provide a secure method for an application ("server application") to share files with another application ("client application"). However, if the client application does not properly handle the filename provided by the server application, an attacker-controlled server application may be able to implement its own malicious FileProvider to overwrite files in the client application's app-specific storage.
In other words: When the client application writes the received file to storage, it should ignore the filename provided by the server application and instead use its own internally generated unique identifier as the filename. Sanitize the provided filename when writing the received file to storage. Contributors: Dimitrios Valsamaras and Michael Peck of Microsoft Threat Intelligence
Or read this on Hacker News