Skip to content

Feature request: joinpath_safe #1631

@lexrobin-te

Description

@lexrobin-te

Is your feature request related to a problem?

I would like to be able to add user input into a URL without allowing path traversal

>>> from yarl import URL
>>> api_url = URL("https://someapi.example/api/v1/")
>>> user_input = "../evil_function"
>>> api_url / "object/id" / user_input
URL('https://someapi.example/api/v1/object/evil_function')
>>> api_url.joinpath("object/id", user_input)
URL('https://someapi.example/api/v1/object/evil_function')

Describe the solution you'd like

I would like a method such as joinpath_safe that pre-encodes path segments before appending them

Describe alternatives you've considered

I am manually encoding the path segments and passing encoded=True but this is inconvenient because yarl doesn't have a public path encoding API so I have to use something else that knows which path segments are dangerous.

Additional context

No response

Code of Conduct

  • I agree to follow the aio-libs Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions