Why are JS and APK files not allowed?

ghost commented 1 month ago

Using a supported version?

[X] I have searched searched open and closed issues for duplicates.
[X] I am using Signal-Desktop as provided by the Signal team, not a 3rd-party package.

Overall summary

.js and .apk can't be sent: "Attachment type not allowed for security reasons". So, just because some JS/APK files can be dangerous, you're blocking all of them? Also, this is very easy to bypass by just renaming the file or putting it in an archive. Still annoying to do, though.

Steps to reproduce

Try to download/upload an .apk or .js file

Expected result

The file is downloaded/uploaded.

Actual result

The file is not downloaded/uploaded.

Screenshots

No response

Signal version

7.10.0

Operating system

Linux 64-bit

Version of Signal on your phone

Irrelevant

Link to debug log

No response

scottnonnenberg-signal commented 1 month ago

Hi there - thanks for your interest on this. Our attachment type limitations have already been discussed quite a bit here: https://github.com/signalapp/Signal-Desktop/issues/3849

ghost commented 2 weeks ago

Patch available here (Linux only though).

signalapp / Signal-Desktop