Broken FTF generation / bundle creation
There seems to be a defect when it comes to generating a bundle (FTF).
The process to create the file will silently fail without any diagnostics if the "Branding" or "Version" fields in the GUI contain some specific characters.
Example: There is a firmware on the Sony servers for the Sony Xperia Tablet Z2 which has the following info
Branding: VMo_FR/DE/AT/CH/BE/NL/PL
Version: 23.0.1.A.4.30
Using this information - e.g. via "Check Updates" - results in total silent failure.
The root cause seems to be the following line in
https://github.com/Androxyde/Flashtool/blob/master/src/flashsystem/Bundle.java
File ftf = new File(OS.getWorkDir()+"/firmwares/"+_device+"_"+_version+"_"+_branding+".ftf");
Here, the data for _version and _branding (and _device) is taken unsanitized for the target file system (in my case: Windows, but all other OS have the same challenge). This is a recipe for the disaster.
Most likely, a file name should be constructed explicitly first, and then some whitelisting on characters should be applied. Example: Remove all characters except [azAZ09-_\.] (note the escaped period at the end of the regex). This should be safe for all file systems involved, at the cost of losing some characters in the process
Alternatively, simply mandate that user explicitly construct a valid file name.
Remark: Somewhere deep down there, there is some kind of error handling problem. That problem must have resulted in some kind of error code or exception, and something must have "silenced" that. This is not Best Practice.