app: anchor the picker start path at the storage root

The containment check was a bare prefix match, so a sibling such as
/storage/emulated/0-evil passed for a root of /storage/emulated/0.

1 files changed, 6 insertions, 2 deletions

diff --git a/app/src/main/java/invalid/lena/rsend/FolderPickerActivity.kt b/app/src/main/java/invalid/lena/rsend/FolderPickerActivity.kt
index 1adccf3..097be3b 100644
--- a/app/src/main/java/invalid/lena/rsend/FolderPickerActivity.kt
+++ b/app/src/main/java/invalid/lena/rsend/FolderPickerActivity.kt
@@ -37,8 +37,7 @@ class FolderPickerActivity : AppCompatActivity() {
         // Start where the field already points, if that is a directory under the
         // root; otherwise at the root itself.
         val start = intent.getStringExtra("start")?.let { File(it) }
-        current = if (start != null && start.isDirectory &&
-            start.absolutePath.startsWith(root.absolutePath)) start else root
+        current = if (start != null && start.isDirectory && underRoot(start)) start else root
 
         findViewById<Button>(R.id.use).setOnClickListener {
             setResult(RESULT_OK, Intent().putExtra("path", current.absolutePath))
@@ -80,6 +79,11 @@ class FolderPickerActivity : AppCompatActivity() {
         }
     }
 
+    // Anchored at a path separator so /storage/emulated/0-evil does not pass
+    // for a root of /storage/emulated/0.
+    private fun underRoot(f: File): Boolean =
+        f.absolutePath == root.absolutePath || f.absolutePath.startsWith(root.absolutePath + "/")
+
     private fun addRow(label: String, dir: File) {
         val row = layoutInflater.inflate(R.layout.item_dir, list, false)
         row.findViewById<TextView>(R.id.dirName).text = label