Closed Bug 2054384 (CVE-2026-100823) Opened 2 months ago Closed 21 days ago

Download completion notification truncates long filenames from the end, hiding the file extension

Tracking

()

Status:

RESOLVED FIXED

Milestone:

157 Branch

Tracking Flags:

Tracking

Status

firefox157

---

fixed

People

(Reporter: samad1082280, Assigned: giorga)

References

Details

(Keywords: csectype-spoof, reporter-external, sec-low, Whiteboard: [fxdroid][android-core][adv-main157+])

Attachments

(4 files)

POC.mp4 2 months ago Abdul Samad 2.95 MB, video/mp4		Details
POC - Firefox.png 2 months ago Abdul Samad 62.77 KB, image/png		Details
POC - Chrome.jpeg 2 months ago Abdul Samad 42.69 KB, image/jpeg		Details
Bug 2054384 - Download notifications should truncate long filenames in the middle. 1 month ago Iorga Gabriel 48 bytes, text/x-phabricator-request		Details \| Review

Abdul Samad

Reporter

Description

•

2 months ago

Attached video POC.mp4 — Details

Steps to reproduce:

Summary

When a file with a long name is downloaded, the Android download completion
notification truncates the filename from the end. This causes the file extension
to be completely hidden, making it impossible to identify the file type from the
notification.

Steps to Reproduce

Host a file with a long filename (e.g.,
"this_is_a_very_long_filename_containing_sample_text_for_the_flask_server.txt")
on any local or remote HTTP server.
Open Firefox for Android and navigate to the file URL.
Tap the download button and confirm the download dialog.
Observe the Android notification bar after the download completes.

POC

POC video is also attached, POC Code is available below

from flask import Flask, send_file, render_template_string
import io

app = Flask(__name__)

FILENAME = "this_is_a_very_long_filename_containing_sample_text_for_the_flask_server_&_this_is_a_very_long_filename_containing_sample_text_for_the_flask_server.txt"

FILE_CONTENT = """\
Hello, World! This is a sample text file with a very long name.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor
incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis
nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore
eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt
in culpa qui officia deserunt mollit anim id est laborum.

This file is served by a simple Flask web server.
Visit http://0.0.0.0:5000/ to see this content rendered in the browser.
"""

HTML_TEMPLATE = """
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Text File Server</title>
    <style>
        body { font-family: Arial, sans-serif; max-width: 800px; margin: 60px auto; padding: 0 24px; background: #f5f5f5; }
        .card { background: white; border-radius: 10px; padding: 32px; box-shadow: 0 2px 8px rgba(0,0,0,0.08); }
        h1 { color: #222; margin-top: 0; }
        .filename { background: #f0f0f0; padding: 10px 14px; border-radius: 6px; font-family: monospace; font-size: 13px; word-break: break-all; color: #555; }
        pre { background: #fafafa; border: 1px solid #e0e0e0; padding: 20px; border-radius: 6px; white-space: pre-wrap; line-height: 1.6; }
        .btn { display: inline-block; margin-top: 16px; padding: 12px 24px; background: #0066cc; color: white; text-decoration: none; border-radius: 6px; font-size: 15px; }
        .btn:hover { background: #0052a3; }
    </style>
</head>
<body>
    <div class="card">
        <h1>📄 Text File Server</h1>
        <p><strong>Filename:</strong></p>
        <div class="filename">{{ filename }}</div>
        <h2>Content:</h2>
        <pre>{{ content }}</pre>
        <a class="btn" href="/download">⬇ Download File</a>
    </div>
</body>
</html>
"""

@app.route("/")
def index():
    return render_template_string(HTML_TEMPLATE, filename=FILENAME, content=FILE_CONTENT)

@app.route("/download")
def download():
    return send_file(
        io.BytesIO(FILE_CONTENT.encode("utf-8")),
        as_attachment=True,
        download_name=FILENAME,
        mimetype="text/plain"
    )

if __name__ == "__main__":
    print(f"Server running at http://0.0.0.0:5000/")
    app.run(host="0.0.0.0", debug=True, port=5000)

Suggested Fix

Apply middle-truncation when constructing the notification title, preserving
the file extension suffix — the same strategy Chrome uses.

Actual results:

Actual Result

The notification truncates the filename from the end, completely cutting off
the .txt extension:

this_is_a_very_long_filename_containing_sample_text_for_the_flask_server&_thi...

The word "Download completed" appears below, but no file type is visible.

Expected results:

Expected Result

The notification should show the filename in a way that preserves the file
extension — either by showing the full name, or by truncating from the middle:

this_is_a_very_long_f....txt

Abdul Samad

Reporter

Comment 1

•

2 months ago

Environment Details

152.0.4 (Build #2016169815), e39c605adc0fc049a165d7fe4a3f6517b761edf7
GV: 152.0.4-20260629141727
AS: 152.0.1
OS: Android 16
Device: Xiaomi 15T

Abdul Samad

Reporter

Comment 2

•

2 months ago

Attached image POC - Firefox.png — Details

POC image of Download Notification of Firefox

Abdul Samad

Reporter

Comment 3

•

2 months ago

Attached image POC - Chrome.jpeg — Details

POC image of Download Notification of Chrome