Bug 1789500 - filename sanitization may cut surrogate pairs when truncating. r=NeilDeakin

Differential Revision: https://phabricator.services.mozilla.com/D157516

uriloader/exthandler/nsExternalHelperAppService.cpp

@@ -3599,7 +3599,10 @@ void nsExternalHelperAppService::SanitizeFileName(nsAString& aFileName,
           nextChar = '_';
         }
 
-        lastNonTrimmable = int32_t(outFileName.Length()) + 1;
+        // Don't truncate surrogate pairs in the middle.
+        lastNonTrimmable =
+            int32_t(outFileName.Length()) +
+            (NS_IS_HIGH_SURROGATE(H_SURROGATE(nextChar)) ? 2 : 1);
       }
     }
 

uriloader/exthandler/tests/unit/test_filename_sanitize.js

@@ -10,8 +10,8 @@ http://creativecommons.org/publicdomain/zero/1.0/ */
 add_task(async function validate_filename_method() {
   let mimeService = Cc["@mozilla.org/mime;1"].getService(Ci.nsIMIMEService);
 
-  function checkFilename(filename, flags) {
-    return mimeService.validateFileNameForSaving(filename, "image/png", flags);
+  function checkFilename(filename, flags, mime = "image/png") {
+    return mimeService.validateFileNameForSaving(filename, mime, flags);
   }
 
   Assert.equal(checkFilename("basicfile.png", 0), "basicfile.png");
@@ -160,6 +160,10 @@ add_task(async function validate_filename_method() {
     "test_ﾃｽﾄ_T E_S T.png"
   );
 
+  // Check we don't invalidate surrogate pairs when trimming.
+  Assert.equal(checkFilename("test😀", 0, ""), "test😀");
+  Assert.equal(checkFilename("test😀😀", 0, ""), "test😀😀");
+
   // Now check some media types
   Assert.equal(
     mimeService.validateFileNameForSaving("video.ogg", "video/ogg", 0),