fix(android): path traversal vulnerability

README.md

@@ -1,5 +1,9 @@
 # react-native-document-picker
 
+📣📣 A full rewrite of the library is in progress. 📣📣
+
+Please subscribe to [this issue](https://github.com/rnmods/react-native-document-picker/issues/603) to receive updates.
+
 🚧🚧 GH discussions available 🚧🚧
 
 If you want to ask questions, we opened [GH discussions](https://github.com/rnmods/react-native-document-picker/discussions) for that purpose! 🤗 Issue tracker is now reserved for bugs and feature requests only and issues not following the issue template can be closed. Thank you!

android/src/main/java/com/reactnativedocumentpicker/RNDocumentPickerModule.java

@@ -316,7 +316,7 @@ private void copyFileToLocalStorage(Context context, WritableMap map, Uri uri) {
         if (fileName == null) {
           fileName = String.valueOf(System.currentTimeMillis());
         }
-        File destFile = new File(dir, fileName);
+        File destFile = safeGetDestination(new File(dir, fileName), dir.getCanonicalPath());
         Uri copyPath = copyFile(context, uri, destFile);
         map.putString(FIELD_FILE_COPY_URI, copyPath.toString());
       } catch (Exception e) {
@@ -326,6 +326,14 @@ private void copyFileToLocalStorage(Context context, WritableMap map, Uri uri) {
       }
     }
 
+    public File safeGetDestination(File destFile, String expectedDir) throws IllegalArgumentException, IOException {
+      String canonicalPath = destFile.getCanonicalPath();
+      if (!canonicalPath.startsWith(expectedDir)) {
+        throw new IllegalArgumentException("The copied file is attempting to write outside of the target directory.");
+      }
+      return destFile;
+    }
+
     public static Uri copyFile(Context context, Uri uri, File destFile) throws IOException {
       try(InputStream inputStream = context.getContentResolver().openInputStream(uri);
           FileOutputStream outputStream = new FileOutputStream(destFile)) {