Fix: sub path join is url encode, can not check prefix

internal/cache/alist.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
+	"path"
 	"strings"
 	"time"
 
@@ -184,10 +184,7 @@ func NewAlistMovieCacheInitFunc(movie *model.Movie, subPath string) func(ctx con
 			return nil, err
 		}
 		if movie.IsFolder {
-			newPath, err := url.JoinPath(truePath, subPath)
+			newPath := path.Join(truePath, subPath)
-			if err != nil {
-				return nil, err
-			}
 			// check new path is in parent path
 			if !strings.HasPrefix(newPath, truePath) {
 				return nil, errors.New("sub path is not in parent path")

server/handlers/movie.go

@@ -12,6 +12,7 @@ import (
 	"math/rand"
 	"net/http"
 	"net/url"
+	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -309,10 +310,7 @@ func listVendorDynamicMovie(ctx context.Context, reqUser *op.User, room *op.Room
 		if err != nil {
 			return nil, fmt.Errorf("load alist server id error: %w", err)
 		}
-		newPath, err := url.JoinPath(truePath, subPath)
+		newPath := path.Join(truePath, subPath)
-		if err != nil {
-			return nil, fmt.Errorf("join path error: %w", err)
-		}
 		// check new path is in parent path
 		if !strings.HasPrefix(newPath, truePath) {
 			return nil, fmt.Errorf("sub path is not in parent path")