code: func SafeJoin(paths ...string) (string, error) {
  	result := path.Join(paths...)
  	// check filepath
  	if !strings.HasPrefix(result, filepath.Clean(paths[0])+string(os.PathSeparator)) {
  		return "", errors.New("invalid filepath")
  	}
  
  	return result, nil
  }
docs: // SafeJoin safe join https://snyk.io/research/zip-slip-vulnerability#go