Rooting Samsung Galaxy Pocket
Whether the file is on mediafire or xda, you still run the risk of a user putting up a bad file (whether maliciously or incompetently). You have to trust someone unless you decide to make your own rom from scratch. 

You could always open the update.zip file and do a cursory look at its contents. And if the poster has a good history, that gives points in their favor. Many posters on xda host their files on external download tools like mediafire; it doesn't inherently make the file more suspicious.