feat(serverHandler/upload): parse form file path manually

RFC 7578, Section 4.2 requires that if a filename is provided, the
directory path information must not be used.

Since Go 1.17, Part.FileName() will strip directory information.

The directory information is needed for uploading, parse manually
instead.

Author: marjune163

src/serverHandler/upload.go

@@ -4,6 +4,8 @@ import (
 	"../util"
 	"errors"
 	"io"
+	"mime"
+	"mime/multipart"
 	"net/http"
 	"os"
 	"path"
@@ -40,6 +42,17 @@ func getAvailableFilename(fsPrefix, filename string, mustAppendSuffix bool) stri
 	return ""
 }
 
+// RFC 7578, Section 4.2 requires that if a filename is provided, the
+// directory path information must not be used.
+// Since Go 1.17, Part.FileName() will strip directory information.
+// However, the directory information is needed for uploading.
+// Parse manually instead.
+func getPartFilePath(part *multipart.Part) string {
+	cd := part.Header.Get("Content-Disposition")
+	_, params, _ := mime.ParseMediaType(cd)
+	return params["filename"]
+}
+
 func (h *handler) saveUploadFiles(fsPrefix string, createDir, overwriteExists bool, aliasSubItems []os.FileInfo, r *http.Request) bool {
 	errs := []error{}
 
@@ -58,7 +71,7 @@ func (h *handler) saveUploadFiles(fsPrefix string, createDir, overwriteExists bo
 			break
 		}
 
-		inputPartFilePath := part.FileName()
+		inputPartFilePath := getPartFilePath(part)
 		if len(inputPartFilePath) == 0 {
 			continue
 		}