From a52a15e9d195fb0a0edc75db41abd022ca1a301d Mon Sep 17 00:00:00 2001
From: Martin Dosch <martin@mdosch.de>
Date: Sun, 12 Sep 2021 09:26:20 +0200
Subject: [PATCH] Xml-escape filename in http-upload (thanks Zash).

---
 httpupload.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/httpupload.go b/httpupload.go
index a41237e..f068df9 100644
--- a/httpupload.go
+++ b/httpupload.go
@@ -121,6 +121,8 @@ func httpUpload(client *xmpp.Client, jserver string, filePath string) string {
 
 	// Get file name
 	fileName := filepath.Base(filePath)
+	var fileNameEscaped bytes.Buffer
+	xml.Escape(&fileNameEscaped, []byte(fileName))
 
 	// Query server for disco#items
 	id := getID()
@@ -196,7 +198,7 @@ func httpUpload(client *xmpp.Client, jserver string, filePath string) string {
 	go getIQ(client, id, c)
 	_, err = client.RawInformation(client.JID(), uploadComponent, id, "get",
 		"<request xmlns='urn:xmpp:http:upload:0' filename='"+
-			fileName+"' size='"+strconv.FormatInt(fileSize, 10)+
+			fileNameEscaped.String()+"' size='"+strconv.FormatInt(fileSize, 10)+
 			"' content-type='"+mimeType+"' />")
 	if err != nil {
 		log.Fatal(err)