File upload working

src/files.rs

@@ -58,6 +58,17 @@ fn is_valid_full_path(base: &Path, path: &str) -> Option<PathBuf> {
                 }
             })
             .ok()
+    } else if let Ok(path) = path.canonicalize().and_then(|path| {
+        if path.starts_with(base) {
+            Ok(path)
+        } else {
+            Err(io::Error::new(
+                io::ErrorKind::Other,
+                "Path below base directory",
+            ))
+        }
+    }) {
+        Some(path)
     } else {
         None
     }
@@ -102,6 +113,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_from_absolute_path_test() {
+        let base = env::temp_dir();
+        let mut test_file = PathBuf::from(&base);
+        test_file.push("test.png");
+        File::create(&test_file).unwrap();
+
+        assert!(is_valid_full_path(&base, test_file.to_str().unwrap()).is_some());
+
+        let path = "relative/path/test.png";
+        let mut test_file = PathBuf::from(&base);
+        test_file.push(path);
+        create_dir_all(test_file.parent().unwrap()).unwrap();
+        File::create(test_file).unwrap();
+
+        assert_eq!(
+            Some(PathBuf::from("/tmp/relative/path/test.png")),
+            is_valid_full_path(&base, path)
+        );
+    }
+
     #[test]
     fn png_valid_extension_test() {
         assert!(is_image_or_video(Path::new("image.png")));