chore: restrict the html file (#749)

* restrict the html file * replace spaces with table * remove space
usememos · Dec 19, 2022 · 726285e · 726285e
1 parent bd6ab71
commit 726285e
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/server/resource.go b/server/resource.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/usememos/memos/api"
@@ -42,6 +43,10 @@ func (s *Server) registerResourceRoutes(g *echo.Group) {
 		}
 
 		filename := file.Filename
+		if strings.HasSuffix(filename, ".html") {
+			return echo.NewHTTPError(http.StatusBadRequest, "html file is not allowed")
+		}
+
 		filetype := file.Header.Get("Content-Type")
 		size := file.Size
 		src, err := file.Open()