From 116bb50364c74c8024aab6178db4ba1c19d52ba0 Mon Sep 17 00:00:00 2001
From: Alexander-Ger-Reich
 <50119493+Alexander-Ger-Reich@users.noreply.github.com>
Date: Sat, 13 Dec 2025 10:04:10 +0100
Subject: [PATCH] Update service.go

---
 server/service/download/service.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/server/service/download/service.go b/server/service/download/service.go
index d677435..97949e4 100644
--- a/server/service/download/service.go
+++ b/server/service/download/service.go
@@ -152,6 +152,22 @@ func (s *Service) DownloadImageFile(c *gin.Context) {
             return
         }
 
+		filename = filepath.Base(filename)
+
+		if filename != part.FileName() {
+			log.Warn("path detected in filename")
+			rsp.ErrRsp(c, -1, "invalid filename")
+			defer os.Remove(sentinelPath)
+			return
+		}
+
+		if strings.Contains(filename, "..") {
+			log.Warn("path traversal attempt")
+			rsp.ErrRsp(c, -1, "invalid filename")
+			defer os.Remove(sentinelPath)
+			return
+		}
+
 		data, err := os.ReadFile(sentinelPath)
 		if err != nil {
 			log.Error("Read failed")