From ec26d6f8ce10129eaffeb9c737464a4556ac4756 Mon Sep 17 00:00:00 2001
From: SlaVcE <102253539+SlaVcE14@users.noreply.github.com>
Date: Mon, 23 Oct 2023 20:46:37 +0200
Subject: [PATCH 1/3] Fix Uncontrolled data used

---
 app/src/main/java/com/sjapps/jsonlist/FileSystem.java | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/app/src/main/java/com/sjapps/jsonlist/FileSystem.java b/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
index dc6af44..e1ebed6 100644
--- a/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
+++ b/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
@@ -6,6 +6,7 @@
 import com.google.gson.JsonObject;
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.Scanner;
 public class FileSystem {
 
@@ -19,6 +20,14 @@ public static JsonArray loadDataToJsonArray(JsonElement data) {
 
     public static String LoadDataFromFile(MainActivity mainActivity, Uri uri) {
 
+        String path = uri.getPath();
+
+        if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
+            Path normalized = java.nio.file.FileSystems.getDefault().getPath(path).normalize();
+            if (normalized.startsWith("/data"))
+                throw new SecurityException();
+        }
+
         StringBuilder sb = new StringBuilder();
         FileInputStream inputStream = null;
         Scanner sc = null;

From 434ef6f0f2a3d9517480dd1ce1a1bdd68869461d Mon Sep 17 00:00:00 2001
From: SlaVcE <102253539+SlaVcE14@users.noreply.github.com>
Date: Mon, 23 Oct 2023 20:50:12 +0200
Subject: [PATCH 2/3] Update FileSystem.java

---
 app/src/main/java/com/sjapps/jsonlist/FileSystem.java | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/app/src/main/java/com/sjapps/jsonlist/FileSystem.java b/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
index e1ebed6..9b95983 100644
--- a/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
+++ b/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
@@ -20,9 +20,8 @@ public static JsonArray loadDataToJsonArray(JsonElement data) {
 
     public static String LoadDataFromFile(MainActivity mainActivity, Uri uri) {
 
-        String path = uri.getPath();
-
         if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
+            String path = uri.getPath();
             Path normalized = java.nio.file.FileSystems.getDefault().getPath(path).normalize();
             if (normalized.startsWith("/data"))
                 throw new SecurityException();

From b80e57af18f7b90addd02e7fd7852f611df6785e Mon Sep 17 00:00:00 2001
From: SlaVcE <102253539+SlaVcE14@users.noreply.github.com>
Date: Mon, 23 Oct 2023 21:28:41 +0200
Subject: [PATCH 3/3] Update FileSystem.java

---
 app/src/main/java/com/sjapps/jsonlist/FileSystem.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/src/main/java/com/sjapps/jsonlist/FileSystem.java b/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
index 9b95983..5575122 100644
--- a/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
+++ b/app/src/main/java/com/sjapps/jsonlist/FileSystem.java
@@ -22,6 +22,8 @@ public static String LoadDataFromFile(MainActivity mainActivity, Uri uri) {
 
         if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
             String path = uri.getPath();
+            if (path.contains("../"))
+                throw new SecurityException();
             Path normalized = java.nio.file.FileSystems.getDefault().getPath(path).normalize();
             if (normalized.startsWith("/data"))
                 throw new SecurityException();