hostname from server maybe trusted without check and used in file path

[alexanderkjall]

I tried to read through the code prior to using it, and here:

https://github.com/NilsIrl/MozWire/blob/trunk/src/main.rs#L442

The server.hostname variable is used, as far as I can tell from the source code this value comes directly from the server and there is no checks to verify that it doesn't contain something that might cause a path traversal (i.e. ../ ).

I have not verified this in any way, as it was annoying to untangle the oauth things in front of it.

It also feels like a very low risk vulnerability, as the software is hardcoded to go against the mozilla servers.