Check for local URLs more strictly.

Telegram/SourceFiles/core/file_utilities.h

@@ -7,6 +7,10 @@ https://github.com/telegramdesktop/tdesktop/blob/master/LEGAL
 */
 #pragma once
 
+namespace Core {
+bool UrlIsLocal(const QUrl &url);
+} // namespace Core
+
 namespace Main {
 class Session;
 } // namespace Main
@@ -45,7 +49,7 @@ void ShowInFolder(const QString &filepath);
 namespace internal {
 
 inline QString UrlToLocalDefault(const QUrl &url) {
-	return url.toLocalFile();
+	return Core::UrlIsLocal(url) ? url.toLocalFile() : QString();
 }
 
 void UnsafeOpenUrlDefault(const QString &url);

Telegram/SourceFiles/core/mime_type.cpp

@@ -226,13 +226,24 @@ bool CanSendFiles(not_null<const QMimeData*> data) {
 	if (data->hasImage()) {
 		return true;
 	} else if (const auto urls = ReadMimeUrls(data); !urls.empty()) {
-		if (ranges::all_of(urls, &QUrl::isLocalFile)) {
+		if (ranges::all_of(urls, UrlIsLocal)) {
 			return true;
 		}
 	}
 	return false;
 }
 
+bool UrlIsLocal(const QUrl &url) {
+	if (!url.isLocalFile()) {
+		return false;
+	}
+	const auto result = url.toLocalFile();
+	if (result.startsWith("//")) {
+		return false;
+	}
+	return !result.isEmpty();
+}
+
 QString FileExtension(const QString &filepath) {
 	const auto reversed = ranges::views::reverse(filepath);
 	const auto last = ranges::find_first_of(reversed, ".\\/");

Telegram/SourceFiles/core/mime_type.h

@@ -68,6 +68,7 @@ struct MimeImageData {
 [[nodiscard]] QString ReadMimeText(not_null<const QMimeData*> data);
 [[nodiscard]] QList<QUrl> ReadMimeUrls(not_null<const QMimeData*> data);
 [[nodiscard]] bool CanSendFiles(not_null<const QMimeData*> data);
+[[nodiscard]] bool UrlIsLocal(const QUrl &url);
 
 enum class NameType : uchar {
 	Unknown,