← All posts

Posts tagged #python

Sanitising is not identifying: deriving a filename from untrusted data without collisions

12 min

You take a title and an id from a remote API and build a filename out of them. Sanitising the title is right. Sanitising the id is what makes two different items overwrite each other, because sanitising is lossy on purpose and an identifier has to survive intact. Five real collisions, percent-encoding as the fix, and the six bytes of a 255-byte budget that are not in the name at all.