cleanup file info, fix injection vulnerability