Originally filed by dxa4481 on GitHub

So on this line
https://github.com/decause/feedcloud/blob/master/gencloud.py#L30

What happens if my feed title is something like

../../../../../../../home/decause/Documents/superSecretTextFile

@decause

Excellent question! Do you have any suggestions for a library that normalizes/validates URLs, or another strategy to protect against such shenanigans?

dxa4481

You can try this guy's solution (top answer, not the poster), it's a little lengthy but I think it works

https://stackoverflow.com/questions/6803505/does-my-code-prevent-directory-traversal

dxa4481

I think you got the same thing going on here. The HFOSS one is a little more serious because now you can access any file, not just .txt files. You might want to test out my hunch, I could be mistaken. Depends how the feed parser handles things

https://github.com/decause/hfoss/blob/master/hfossfeedpull.py#L25