gapic-common 1.4.0 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6dbc3fc8f2b53d01d228f377851d21d941cedd307a9528e7ba732c5e8d2565e2
-  data.tar.gz: d6ded505cf91783149b49373f2efb2ef105860705a22f2940c27f6b27d83be39
+  metadata.gz: 11f04f82fc6e98e5ca24d814d6162d68681999b6a7f2305cc32c77c597db2a88
+  data.tar.gz: a36c758ffd65878ac9809c0ecfc515e2c6e0e817f5ad679e8574e5dbeb8a03f6
 SHA512:
-  metadata.gz: e7533c44cae4643cec30b87e96fc61750ca2ba2a3458c711788d51987436b25ca3248f6c8d011cf06a00992eec4458e3403ac0b64850a43d153368cd3a6c0203
-  data.tar.gz: cd51bd91e418f8d5c71c3f6e484b29f4c420121b14baca686309f074928162f97c0259555bd32d28cb6e747a397c99c0e3d5aeb6cd99085d309ed61482af7cfa
+  metadata.gz: 8fb7d4c578dc4b44383ac18e33159fd824465e63df13b10ed2d2fe142c4a9743876d7a3a41cd00680dc3e44cab88f6d3d6185198a8b74a85ace1ff30ee6d9e4e
+  data.tar.gz: 3d508937a578e43a1fe8022557d08a7c01be477b9141a1d055c0d6a1df8e739eca0a9e2f14d178aa90c4b121d44dd12e437d73242250009916645948238af388

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Release History
 
+### 1.4.1 (2026-09-28)
+
+#### Bug Fixes
+
+* validate path parameters and prevent traversal/injection in REST transcoder ([#67](https://github.com/googleapis/ruby-core-libraries/issues/67)) 
+
 ### 1.4.0 (2026-09-23)
 
 #### Features

data/lib/gapic/common/version.rb

@@ -14,6 +14,6 @@
 
 module Gapic
   module Common
-    VERSION = "1.4.0".freeze
+    VERSION = "1.4.1".freeze
   end
 end

data/lib/gapic/rest/grpc_transcoder.rb

@@ -111,12 +111,14 @@ module Gapic
       # @return [Hash{String, String}]
       #   Name to value hash of the variables for the uri template expansion.
       #   The values are percent-escaped with slashes potentially preserved.
+      # @raise [Gapic::Common::Error] If any parameter value fails path traversal or injection validation.
       def bind_uri_values! http_binding, request_hash
         http_binding.field_bindings.to_h do |field_binding|
           field_path_camel = field_binding.field_path.split(".").map { |part| camel_name_for part }.join(".")
           field_value = extract_scalar_value! request_hash, field_path_camel, field_binding.regex
 
           if field_value
+            validate_field_binding! field_binding, field_value
             field_value = field_value.split("/").map { |segment| percent_escape segment }.join("/")
           end
 
@@ -124,6 +126,43 @@ module Gapic
         end
       end
 
+      # Validates a user-supplied parameter value bound to a standard (*) or path (**) URI template variable
+      # to prevent directory traversal exploits.
+      #
+      # @param field_binding [HttpBinding::FieldBinding] The field binding template metadata.
+      # @param field_value [String] The parameter value to validate.
+      # @raise [Gapic::Common::Error] If validation fails.
+      def validate_field_binding! field_binding, field_value
+        validate_path_binding! field_binding, field_value
+      end
+
+      # Validates standard (*) and path (**) parameters by ensuring that no segment in the parameter
+      # value is a directory traversal segment (. or ..).
+      #
+      # Validation Mechanism:
+      # 1. Splits the parameter value by slash (`/`) using `-1` limit to preserve all segments.
+      # 2. Checks each segment. If any segment matches `.` or `..`, it immediately raises
+      #    a `Gapic::Common::Error`, aborting the request.
+      # 3. Empty segments (e.g. duplicate slashes `//` or trailing slashes `/`) are allowed
+      #    by this validator and passed to the server, which handles normalization or returns 400.
+      #
+      # @param field_binding [HttpBinding::FieldBinding] The field binding template metadata.
+      # @param field_value [String] The parameter value to validate.
+      # @raise [Gapic::Common::Error] If validation fails.
+      def validate_path_binding! field_binding, field_value
+        segments = field_value.split("/", -1)
+        segments.each do |segment|
+          next unless [".", ".."].include? segment
+          if field_binding.preserve_slashes
+            raise ::Gapic::Common::Error,
+                  "Value for #{field_binding.field_path} must not contain segments that are exactly '#{segment}'."
+          else
+            raise ::Gapic::Common::Error,
+                  "Invalid value for #{field_binding.field_path} '#{segment}'."
+          end
+        end
+      end
+
       # Percent-escapes a string.
       # @param str [String] String to escape.
       # @return [String] Escaped string.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gapic-common
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.4.1
 platform: ruby
 authors:
 - Google API Authors