Don't prevent download for APK files (currently labeled a 'dangerous' file)

[gabrc52]

• I have searched open and closed issues for duplicates

---

Bug Description

Signal refuses to download an APK file (Android package) on desktop.

Steps to Reproduce

1. Send yourself an APK from a phone
2. Try to download it

Actual Result:

Signal refuses to download the APK file saying "Attachment type not allowed for security reasons"

Expected Result:

It gets downloaded.

Screenshots

Platform Info

Signal Version: Signal Desktop v1.40.1

Operating System: Fedora

Linked Device Version: Signal 5.5.5

Link to Debug Log

Nothing relevant in the log.

Additional information

Probably a fault in the code that checks for malicious files like EXEs.

APKs are not malicious on a computer, and on Android it does let me download the file (but not directly open it). That makes sense since someone knowledgeable enough to use a file manager knows that an APK is potentially dangerous, and this doesn't just prevent the user from opening (installer) the file if they really want to. On the contrary, refusing to download APK on the computer doesn't make sense, especially since they aren't malicious unless the computer has an emulator.

I will download the APK I received from my phone then send it to me using KDE connect or another messaging service to workaround this bug.

[hiqua]

Duplicate: #3849

[gabrc52]

It is not a duplicate, #3849 is arguing against a built-in protection feature, but APKs are a different file type, which is not malicious on the computer so they shouldn't be blocked from getting downloaded in the first place, especially with the Android version letting you download them but the desktop version not letting you.

[Energiereaktor]

Currently there is a workaround for this by renaming the file to something different than *.apk and after the download naming it back to the original file name.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[btTeddy]

This is really pointless feature since Signal users are slightly different target then Messenger

[ghost]

@gabrc52 Patch available here (Linux only though).