aio-libs / aio-libs/yarl

Feature request: `joinpath_safe`

未關閉
#1,631 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
enhancement
主要語言
Python
星號
1.5k
分支
215
平均合併
1 天 2 分鐘
30 天內合併 PR
13

描述

### Is your feature request related to a problem?

I would like to be able to add user input into a URL without allowing path traversal

```python
>>> from yarl import URL
>>> api_url = URL("https://someapi.example/api/v1/")
>>> user_input = "../evil_function"
>>> api_url / "object/id" / user_input
URL('https://someapi.example/api/v1/object/evil_function')
>>> api_url.joinpath("object/id", user_input)
URL('https://someapi.example/api/v1/object/evil_function')
```

### Describe the solution you'd like

I would like a method such as `joinpath_safe` that pre-encodes path segments before appending them

### Describe alternatives you've considered

I am manually encoding the path segments and passing `encoded=True` but this is inconvenient because `yarl` doesn't have a public path encoding API so I have to use something else that knows which path segments are dangerous.

### Additional context

_No response_

### Code of Conduct

- [x] I agree to follow the aio-libs Code of Conduct

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。