Avoid self-XSS

index.html.tmpl

@@ -139,6 +139,17 @@
         document.getElementById('maxUploadSizeLabel').textContent = formatBytes(maxUploadSize);
         document.getElementById('maxUploadSizeText').textContent = formatBytes(maxUploadSize);
 
+        function clearResults() {
+            results.replaceChildren();
+        }
+
+        function showMessage(message) {
+            const div = document.createElement('div');
+            div.className = 'result-item';
+            div.textContent = message;
+            results.replaceChildren(div);
+        }
+
         uploadArea.addEventListener('click', () => fileInput.click());
 
         uploadArea.addEventListener('dragover', (e) => {
@@ -174,14 +185,14 @@
             }
 
             if (oversizedFiles.length > 0) {
-                results.innerHTML = '<div class="result-item">Upload failed: the following file(s) exceed the maximum size of ' +
-                    formatBytes(maxUploadSize) + ': ' + oversizedFiles.join(', ') + '</div>';
+                showMessage('Upload failed: the following file(s) exceed the maximum size of ' +
+                    formatBytes(maxUploadSize) + ': ' + oversizedFiles.join(', '));
                 return;
             }
 
             if (maxUploadSize && totalSize > maxUploadSize) {
-                results.innerHTML = '<div class="result-item">Upload failed: total upload size (' + formatBytes(totalSize) +
-                    ') exceeds the maximum of ' + formatBytes(maxUploadSize) + '</div>';
+                showMessage('Upload failed: total upload size (' + formatBytes(totalSize) +
+                    ') exceeds the maximum of ' + formatBytes(maxUploadSize));
                 return;
             }
 
@@ -192,7 +203,7 @@
 
             progressContainer.style.display = 'block';
             progressBar.style.width = '0%';
-            results.innerHTML = '';
+            clearResults();
 
             const xhr = new XMLHttpRequest();
 
@@ -219,13 +230,13 @@
                             message = xhr.responseText;
                         }
                     }
-                    results.innerHTML = '<div class="result-item">Upload failed: ' + message + '</div>';
+                    showMessage('Upload failed: ' + message);
                 }
                 progressBar.style.width = '100%';
             });
 
             xhr.addEventListener('error', () => {
-                results.innerHTML = '<div class="result-item">Upload failed: Network error</div>';
+                showMessage('Upload failed: Network error');
             });
 
             xhr.open('POST', '/upload');
@@ -233,11 +244,19 @@
         }
 
         function displayResults(urls) {
-            results.innerHTML = '<h3>Download URLs:</h3>';
+            const heading = document.createElement('h3');
+            heading.textContent = 'Download URLs:';
+            results.replaceChildren(heading);
+
             urls.forEach(url => {
                 const div = document.createElement('div');
                 div.className = 'result-item';
-                div.innerHTML = '<a href="' + url + '" target="_blank">' + url + '</a>';
+                const link = document.createElement('a');
+                link.href = url;
+                link.target = '_blank';
+                link.rel = 'noopener noreferrer';
+                link.textContent = url;
+                div.appendChild(link);
                 results.appendChild(div);
             });
         }

main.go

@@ -179,9 +179,11 @@ func handleUpload(w http.ResponseWriter, r *http.Request, start time.Time) {
 		return
 	}
 
-	targetPath := filepath.Join(uploadDir, id, filename)
+	targetDir := filepath.Join(uploadDir, id)
+	targetPath := filepath.Join(targetDir, filename)
 	file, err := os.Create(targetPath)
 	if err != nil {
+		os.Remove(targetDir)
 		http.Error(w, "Failed to create file", http.StatusInternalServerError)
 		logRequest(r, 500, time.Since(start))
 		return
@@ -193,6 +195,7 @@ func handleUpload(w http.ResponseWriter, r *http.Request, start time.Time) {
 	if err != nil {
 		file.Close()
 		os.Remove(targetPath)
+		os.Remove(targetDir)
 		if isMaxBytesError(err) {
 			http.Error(w, fmt.Sprintf("File exceeds maximum upload size of %d bytes", maxUploadSize), http.StatusRequestEntityTooLarge)
 			logRequest(r, 413, time.Since(start))
@@ -238,6 +241,7 @@ func handleMultipartUpload(w http.ResponseWriter, r *http.Request, start time.Ti
 		logRequest(r, 400, time.Since(start))
 		return
 	}
+	defer r.MultipartForm.RemoveAll()
 
 	files := r.MultipartForm.File["files"]
 	if len(files) == 0 {
@@ -263,11 +267,13 @@ func handleMultipartUpload(w http.ResponseWriter, r *http.Request, start time.Ti
 		}
 
 		filename := filepath.Base(fileHeader.Filename)
-		targetPath := filepath.Join(uploadDir, id, filename)
+		targetDir := filepath.Join(uploadDir, id)
+		targetPath := filepath.Join(targetDir, filename)
 
 		dst, err := os.Create(targetPath)
 		if err != nil {
 			src.Close()
+			os.Remove(targetDir)
 			continue
 		}
 
@@ -277,6 +283,7 @@ func handleMultipartUpload(w http.ResponseWriter, r *http.Request, start time.Ti
 
 		if err != nil {
 			os.Remove(targetPath)
+			os.Remove(targetDir)
 			continue
 		}
 
@@ -324,7 +331,7 @@ func handleDownload(w http.ResponseWriter, r *http.Request, start time.Time) {
 	}
 
 	w.Header().Set("Content-Type", detectContentType(filename))
-	w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=\"%s\"", filename))
+	w.Header().Set("Content-Disposition", mime.FormatMediaType("inline", map[string]string{"filename": filename}))
 	w.Header().Set("Content-Length", fmt.Sprintf("%d", stat.Size()))
 
 	io.Copy(w, file)