[release-branch.go1.10] godoc: don't display tar instructions for malformed download query

Ensure that the filename passed via ?download= matches the given
regexp before showing the command-line instructions to download it.

Change-Id: I87d734ebeb1f5e8e1b4311a8be6b3ae18bef8b10
Reviewed-on: https://go-review.googlesource.com/126798
Reviewed-by: Andrew Bonventre <andybons@golang.org>

godoc/static/godocs.js

@@ -253,13 +253,13 @@ function personalizeInstallInstructions() {
 
   var filename = s.substr(prefix.length);
   var filenameRE = /^go1\.\d+(\.\d+)?([a-z0-9]+)?\.([a-z0-9]+)(-[a-z0-9]+)?(-osx10\.[68])?\.([a-z.]+)$/;
-  $('.downloadFilename').text(filename);
-  $('.hideFromDownload').hide();
   var m = filenameRE.exec(filename);
   if (!m) {
     // Can't interpret file name; bail.
     return;
   }
+  $('.downloadFilename').text(filename);
+  $('.hideFromDownload').hide();
 
   var os = m[3];
   var ext = m[6];