Even if you could swear by Snoopy that url.parse removes all kind of path traversal characters (well, can you?) this is a bad idea. No, bar that, this is a horrible horrible idea.