Prevent URI path traversals when downloading files

[smaury]

As file IDs are part of encrypted messages, a malicious submitter could set as file ID an arbitrary value, which is then used to create the relative URL to fetch it.
If the malicious submitter sets as file ID ../path/to/another/API?junk= could force the victim's client to perform a GET request to an arbitrary API (i.e. https://secure....onion/path/to/another/API?junk=<junk>).

[smaury]

I guess implementing something like this at the beginning of the get_file function should be enough:

from re import match
if not match("[0-9a-f]{32}", file_id):
    return false

[lsd-cat]

That's a great catch, thank you!