From 1542eff27f7d67ef56543358e2f623eb4ea8adf9 Mon Sep 17 00:00:00 2001
From: Ganlv <ganlvtech@users.noreply.github.com>
Date: Mon, 17 Dec 2018 08:13:07 +0800
Subject: [PATCH] Fix #1693: file.Filename should not be trusted (#1699)

---
 README.md                             | 4 ++++
 examples/upload-file/multiple/main.go | 4 +++-
 examples/upload-file/single/main.go   | 4 +++-
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index c1f902a9..2dc9e5ff 100644
--- a/README.md
+++ b/README.md
@@ -364,6 +364,10 @@ ids: map[b:hello a:1234], names: map[second:tianou first:thinkerou]
 
 References issue [#774](https://github.com/gin-gonic/gin/issues/774) and detail [example code](examples/upload-file/single).
 
+`file.Filename` **SHOULD NOT** be trusted. See [`Content-Disposition` on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition#Directives) and [#1693](https://github.com/gin-gonic/gin/issues/1693)
+
+> The filename is always optional and must not be used blindly by the application: path information should be stripped, and conversion to the server file system rules should be done.
+
 ```go
 func main() {
 	router := gin.Default()
diff --git a/examples/upload-file/multiple/main.go b/examples/upload-file/multiple/main.go
index a55325ed..2b9d6d91 100644
--- a/examples/upload-file/multiple/main.go
+++ b/examples/upload-file/multiple/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"net/http"
+	"path/filepath"
 
 	"github.com/gin-gonic/gin"
 )
@@ -25,7 +26,8 @@ func main() {
 		files := form.File["files"]
 
 		for _, file := range files {
-			if err := c.SaveUploadedFile(file, file.Filename); err != nil {
+			filename := filepath.Base(file.Filename)
+			if err := c.SaveUploadedFile(file, filename); err != nil {
 				c.String(http.StatusBadRequest, fmt.Sprintf("upload file err: %s", err.Error()))
 				return
 			}
diff --git a/examples/upload-file/single/main.go b/examples/upload-file/single/main.go
index 5d438651..ba289f54 100644
--- a/examples/upload-file/single/main.go
+++ b/examples/upload-file/single/main.go
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"net/http"
+	"path/filepath"
 
 	"github.com/gin-gonic/gin"
 )
@@ -23,7 +24,8 @@ func main() {
 			return
 		}
 
-		if err := c.SaveUploadedFile(file, file.Filename); err != nil {
+		filename := filepath.Base(file.Filename)
+		if err := c.SaveUploadedFile(file, filename); err != nil {
 			c.String(http.StatusBadRequest, fmt.Sprintf("upload file err: %s", err.Error()))
 			return
 		}