clean getNameFromHeader func.

melbahja · Sep 8, 2020 · 87cdd7a · 87cdd7a
1 parent 72a11e5
commit 87cdd7a
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/filename.go b/filename.go
@@ -23,11 +23,12 @@ func GetFilename(URL string) string {
 
 func getNameFromHeader(val string) string {
 
-	if val == "" || strings.Contains(val, "..") || strings.Contains(val, "/") || strings.Contains(val, "\\") {
+	_, params, err := mime.ParseMediaType(val)
+
+	// Prevent path traversal
+	if err != nil || strings.Contains(params["filename"], "..") || strings.Contains(params["filename"], "/") || strings.Contains(params["filename"], "\\") {
 		return ""
 	}
 
-	_, params, _ := mime.ParseMediaType(val)
-
 	return params["filename"]
 }