fix: prevent path traversal in article download endpoints

[tranquac]

Summary

Prevent path traversal in article download endpoints by validating the hash parameter.

Problem

Both ProjectTarDownloadAPI and ProjectZipDownloadAPI use the hash query parameter directly in file path construction:

hash := strings.TrimSpace(c.Query("hash"))
c.File(fmt.Sprintf("storage/article/%s.tar.gz", hash))

A crafted hash value with path traversal sequences can read arbitrary files:

• ?hash=../../etc/passwd → reads storage/article/../../etc/passwd.tar.gz
• With .. sequences, an attacker can escape the storage/article/ directory

Fix

1. Validate hash doesn't contain path separators or .. sequences
2. Use filepath.Join for safe path construction
3. Return 400 error for invalid hash values

Impact

• Type: Path Traversal / Arbitrary File Read (CWE-22)
• Affected endpoints: /article/tar, /article/zip
• Risk: Read arbitrary files on the server
• OWASP: A01:2021 — Broken Access Control