aio-libs / aio-libs/yarl

Feature request: `joinpath_safe`

未关闭
#1,631 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
enhancement
主要语言
Python
星标
1.5k
派生
215
平均合并
1 天 2 分钟
30 天内合并 PR
13

描述

### Is your feature request related to a problem?

I would like to be able to add user input into a URL without allowing path traversal

```python
>>> from yarl import URL
>>> api_url = URL("https://someapi.example/api/v1/")
>>> user_input = "../evil_function"
>>> api_url / "object/id" / user_input
URL('https://someapi.example/api/v1/object/evil_function')
>>> api_url.joinpath("object/id", user_input)
URL('https://someapi.example/api/v1/object/evil_function')
```

### Describe the solution you'd like

I would like a method such as `joinpath_safe` that pre-encodes path segments before appending them

### Describe alternatives you've considered

I am manually encoding the path segments and passing `encoded=True` but this is inconvenient because `yarl` doesn't have a public path encoding API so I have to use something else that knows which path segments are dangerous.

### Additional context

_No response_

### Code of Conduct

- [x] I agree to follow the aio-libs Code of Conduct

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。