Harden path traversal check with filepath.IsLocal before opening files

main.go

@@ -212,6 +212,12 @@ func handleDownload(w http.ResponseWriter, r *http.Request, start time.Time) {
 	id := parts[0]
 	filename := parts[1]
 
+	if !filepath.IsLocal(id) || !filepath.IsLocal(filename) {
+		http.NotFound(w, r)
+		logRequest(r, 404, time.Since(start))
+		return
+	}
+
 	filePath := filepath.Join(uploadDir, id, filename)
 	file, err := os.Open(filePath)
 	if err != nil {
@@ -219,12 +225,6 @@ func handleDownload(w http.ResponseWriter, r *http.Request, start time.Time) {
 		logRequest(r, 404, time.Since(start))
 		return
 	}
-	if !strings.HasPrefix(filePath, uploadDir) {
-		http.NotFound(w, r)
-		logRequest(r, 404, time.Since(start))
-		return
-	}
-
 	defer file.Close()
 
 	stat, err := file.Stat()