bugfix: prevent path traversal (#31)

backend/webui_service/middleware.go

 package webui_service
 
 import (
+	"path/filepath"
+	"strings"
+
 	"github.com/gin-gonic/gin"
 )
 
@@ -14,9 +17,19 @@ func ReturnPublic() gin.HandlerFunc {
 			if destPath[len(destPath)-1] == '/' {
 				destPath = destPath[:len(destPath)-1]
 			}
+			destPath = verifyDestPath(destPath)
 			context.File(destPath)
 		} else {
 			context.Next()
 		}
 	}
 }
+
+func verifyDestPath(requestedURI string) string {
+	destPath := filepath.Clean(requestedURI)
+	// if destPath contains ".." then it is not a valid path
+	if strings.Contains(destPath, "..") {
+		return PublicPath
+	}
+	return destPath
+}