The code above doesn't guarantee what you're saying here. A user could have a URL like http://localhost:8080/foo/../../../../etc/passwd to escape out of os.getcwd(). It would be good to handle this in the code, or explain here what precautions would need to be made.