[Zope] Can I trust the variables?

Hi, I'm doing a external method that's supposed to zip-up files selected via LocalFS, and I'm wondering if I can trust the special variables set in a request. Can I trust that f.ex. URL/URLn/URLPATHn are from where the external method was called, and not set by the user via http-headers? Have anybody else added support for ziping up selected files with LocalFS? -jf