{"action":"created","issue":{"url":"https://api.github.com/repos/skeeto/elfeed/issues/90","labels_url":"https://api.github.com/repos/skeeto/elfeed/issues/90/labels{/name}","comments_url":"https://api.github.com/repos/skeeto/elfeed/issues/90/comments","events_url":"https://api.github.com/repos/skeeto/elfeed/issues/90/events","html_url":"https://github.com/skeeto/elfeed/pull/90","id":82604343,"number":90,"title":"adding dowloading all enclosures of the current entry function and binding","user":{"login":"seblemaguer","id":4820197,"avatar_url":"https://avatars.githubusercontent.com/u/4820197?v=3","gravatar_id":"","url":"https://api.github.com/users/seblemaguer","html_url":"https://github.com/seblemaguer","followers_url":"https://api.github.com/users/seblemaguer/followers","following_url":"https://api.github.com/users/seblemaguer/following{/other_user}","gists_url":"https://api.github.com/users/seblemaguer/gists{/gist_id}","starred_url":"https://api.github.com/users/seblemaguer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seblemaguer/subscriptions","organizations_url":"https://api.github.com/users/seblemaguer/orgs","repos_url":"https://api.github.com/users/seblemaguer/repos","events_url":"https://api.github.com/users/seblemaguer/events{/privacy}","received_events_url":"https://api.github.com/users/seblemaguer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-05-29T22:00:16Z","updated_at":"2015-05-30T01:39:56Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/skeeto/elfeed/pulls/90","html_url":"https://github.com/skeeto/elfeed/pull/90","diff_url":"https://github.com/skeeto/elfeed/pull/90.diff","patch_url":"https://github.com/skeeto/elfeed/pull/90.patch"},"body":"I propose to add a download function and the binding to easily access to enclosures (I used this method to get my podcasts audio files)\r\n"},"comment":{"url":"https://api.github.com/repos/skeeto/elfeed/issues/comments/106971377","html_url":"https://github.com/skeeto/elfeed/pull/90#issuecomment-106971377","issue_url":"https://api.github.com/repos/skeeto/elfeed/issues/90","id":106971377,"user":{"login":"skeeto","id":29988,"avatar_url":"https://avatars.githubusercontent.com/u/29988?v=3","gravatar_id":"","url":"https://api.github.com/users/skeeto","html_url":"https://github.com/skeeto","followers_url":"https://api.github.com/users/skeeto/followers","following_url":"https://api.github.com/users/skeeto/following{/other_user}","gists_url":"https://api.github.com/users/skeeto/gists{/gist_id}","starred_url":"https://api.github.com/users/skeeto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skeeto/subscriptions","organizations_url":"https://api.github.com/users/skeeto/orgs","repos_url":"https://api.github.com/users/skeeto/repos","events_url":"https://api.github.com/users/skeeto/events{/privacy}","received_events_url":"https://api.github.com/users/skeeto/received_events","type":"User","site_admin":false},"created_at":"2015-05-30T01:39:56Z","updated_at":"2015-05-30T01:39:56Z","body":"I like the idea -- I'll use it myself when it's ready -- but this patch still needs more work. As is, a feed host could perform a remote code execution attack against Elfeed's Windows users with an enclosure URL along the lines of:\r\n\r\n    http://example.com/~\\.emacs\r\n\r\nOr, with `~/Downloads` being a likely `output-directory` candidate:\r\n\r\n    http://example.com/..\\.emacs\r\n\r\nInstead of `format`, use `expand-file-name`. Instead of `replace-regexp-in-string`, use `url-generic-parse-url`, `url-path-and-query` (maybe strip off the query with a regexp?), `url-unhex-string`, and `file-name-nondirectory`. That way you're never assuming anything about the host system's file separator character.\r\n"}}