chore: restrict the html file (#749)

* restrict the html file

* replace spaces with table

* remove space

server/resource.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/usememos/memos/api"
@@ -42,6 +43,10 @@ func (s *Server) registerResourceRoutes(g *echo.Group) {
 		}
 
 		filename := file.Filename
+		if strings.HasSuffix(filename, ".html") {
+			return echo.NewHTTPError(http.StatusBadRequest, "html file is not allowed")
+		}
+
 		filetype := file.Header.Get("Content-Type")
 		size := file.Size
 		src, err := file.Open()