fix: security vulnerability when file downloading is not permit

fix: security vulnerability when file downloading is not permit #100