gapic-common 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6dbc3fc8f2b53d01d228f377851d21d941cedd307a9528e7ba732c5e8d2565e2
-  data.tar.gz: d6ded505cf91783149b49373f2efb2ef105860705a22f2940c27f6b27d83be39
+  metadata.gz: f9cc2de9bcbe93a62a1706acc73f6d37064bbde7a81a5c9fd434570ed8c6e22f
+  data.tar.gz: 3be68b0522ce0e3465bfb555820c7c73882f2e1bf36ac009fd4bb4f31c0bb3bd
 SHA512:
-  metadata.gz: e7533c44cae4643cec30b87e96fc61750ca2ba2a3458c711788d51987436b25ca3248f6c8d011cf06a00992eec4458e3403ac0b64850a43d153368cd3a6c0203
-  data.tar.gz: cd51bd91e418f8d5c71c3f6e484b29f4c420121b14baca686309f074928162f97c0259555bd32d28cb6e747a397c99c0e3d5aeb6cd99085d309ed61482af7cfa
+  metadata.gz: f958c2009dead1a09f0f20a9dda26f65d1698399657462b47b501297aff0e6af7496b4b0314237485bbb4f9a61d3866b9ee8e61ac26469c0ee69184c53cddd5b
+  data.tar.gz: e8fd4368fab545fbc33636d5999e73bd9f8b664006f5967929cd8e09b25cfafb22e34a17d58ce1481b94474d952d2c7add11ba7644ba77ffab23b98c2b83728a

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Release History
 
+### 1.5.0 (2026-09-29)
+
+#### Features
+
+* Resumable Media Upload functionality implementation ([#72](https://github.com/googleapis/ruby-core-libraries/issues/72)) 
+#### Documentation
+
+* remove stale preview notice and disclaimer from READMEs ([#77](https://github.com/googleapis/ruby-core-libraries/issues/77)) 
+
+### 1.4.1 (2026-09-28)
+
+#### Bug Fixes
+
+* validate path parameters and prevent traversal/injection in REST transcoder ([#67](https://github.com/googleapis/ruby-core-libraries/issues/67)) 
+
 ### 1.4.0 (2026-09-23)
 
 #### Features

data/README.md

@@ -61,9 +61,6 @@ See the {file:CONTRIBUTING.md CONTRIBUTING} documentation for more information o
 
 ## Versioning
 
-This library is currently a **preview** with no guarantees of stability or support. Please get
-involved and let us know if you find it useful and we'll work towards a stable version.
+This library follows [Semantic Versioning](http://semver.org/).
 
-## Disclaimer
-
-This is not an official Google product.
+This library is considered to be stable and will not have backwards-incompatible changes introduced in subsequent minor releases.

data/lib/gapic/common/retry_policy.rb

@@ -19,6 +19,12 @@ module Gapic
     ##
     # Gapic Common retry policy base class.
     #
+    # A policy distinguishes "set to this value" from "never set". Every setting is stored as `nil`
+    # until someone supplies it, and the reader for each substitutes the corresponding `DEFAULT_`
+    # constant on the way out, so a reader can never say which of the two happened. That distinction is
+    # what lets {#apply_defaults} fill in gaps without overwriting a caller's choices, and {#overrides}
+    # report what a caller actually asked for.
+    #
     class RetryPolicy
       # @return [Numeric] Default initial delay in seconds.
       DEFAULT_INITIAL_DELAY = 1
@@ -111,6 +117,34 @@ module Gapic
         @retry_predicate
       end
 
+      ##
+      # @private
+      # The settings this policy actually carries, as keyword arguments for {RetryPolicy.initialize}.
+      #
+      # A key is present only if that setting was explicitly supplied; a key that was never set is
+      # absent rather than `nil`. This is what the readers cannot tell you — {#max_delay} returns
+      # {DEFAULT_MAX_DELAY} whether the caller chose that number or said nothing — so it is the only
+      # safe way to carry one policy's settings onto another without dragging defaults along, and
+      # without mistaking a deliberate choice that happens to equal a default for silence.
+      #
+      # An empty `retry_codes` list counts as unset. It retries nothing, which is exactly what an
+      # unset list does, so there is nothing for it to carry.
+      #
+      # @return [Hash{Symbol=>Object}] Explicitly set settings only
+      def overrides
+        # Assigns nil, and so omits the key, when the list is absent or empty.
+        retry_codes = @retry_codes unless @retry_codes.nil? || @retry_codes.empty?
+        {
+          initial_delay:   @initial_delay,
+          max_delay:       @max_delay,
+          multiplier:      @multiplier,
+          retry_codes:     retry_codes,
+          timeout:         @timeout,
+          jitter:          @jitter,
+          retry_predicate: @retry_predicate
+        }.compact
+      end
+
       ##
       # Returns a duplicate in a non-executing state, i.e. with the deadline
       # and current delay reset.

data/lib/gapic/common/version.rb

@@ -14,6 +14,6 @@
 
 module Gapic
   module Common
-    VERSION = "1.4.0".freeze
+    VERSION = "1.5.0".freeze
   end
 end

data/lib/gapic/logging_concerns.rb

@@ -67,6 +67,10 @@ module Gapic
         log(Logger::DEBUG, &)
       end
 
+      def warn(&)
+        log(Logger::WARN, &)
+      end
+
       ##
       # @private
       # Builder for a log entry, passed to {StubLogger#log}.

data/lib/gapic/rest/client_stub.rb

@@ -287,17 +287,27 @@ module Gapic
           entry.set "requestId", request_id
           entry.message = "Sending request to #{entry.service}.#{method_name} (try #{try_number})"
         end
-        body = body.to_s
+        body_str = body.to_s
         metadata = metadata.to_h rescue {}
-        return if body.empty? && metadata.empty?
+        return if body_str.empty? && metadata.empty?
         stub_logger.debug do |entry|
           entry.set "requestId", request_id
-          entry.set "request", body
+          entry.set "request", abridge_request_body(body_str)
           entry.set "headers", metadata
           entry.message = "(request payload as JSON)"
         end
       end
 
+      def abridge_request_body body_str
+        utf8_body = body_str.dup.force_encoding Encoding::UTF_8
+        if body_str.bytesize > 1024 || !utf8_body.valid_encoding?
+          prefix_hex = body_str.byteslice(0, 32).unpack1 "H*"
+          "<#{body_str.bytesize} bytes, first 32: #{prefix_hex}>"
+        else
+          utf8_body
+        end
+      end
+
       def log_response method_name, request_id, try_number, response, is_server_streaming
         return unless stub_logger&.enabled?
         stub_logger.info do |entry|

data/lib/gapic/rest/error.rb

@@ -22,6 +22,9 @@ module Gapic
   module Rest
     # Gapic REST exception class
     class Error < ::Gapic::Common::Error
+      # @private
+      REST_ERROR_PREFIX = "An error has occurred when making a REST request".freeze
+
       # @return [Integer, nil] the http status code for the error
       attr_reader :status_code
       # @return [Object, nil] the text representation of status as parsed from the response body
@@ -79,7 +82,7 @@ module Gapic
 
           if err.response_body
             msg, code, status, details = try_parse_from_body err.response_body
-            message = "An error has occurred when making a REST request: #{msg}" unless msg.nil?
+            message = "#{REST_ERROR_PREFIX}: #{msg}" unless msg.nil?
             status_code = code unless code.nil?
           end
 

data/lib/gapic/rest/grpc_transcoder.rb

@@ -111,12 +111,14 @@ module Gapic
       # @return [Hash{String, String}]
       #   Name to value hash of the variables for the uri template expansion.
       #   The values are percent-escaped with slashes potentially preserved.
+      # @raise [Gapic::Common::Error] If any parameter value fails path traversal or injection validation.
       def bind_uri_values! http_binding, request_hash
         http_binding.field_bindings.to_h do |field_binding|
           field_path_camel = field_binding.field_path.split(".").map { |part| camel_name_for part }.join(".")
           field_value = extract_scalar_value! request_hash, field_path_camel, field_binding.regex
 
           if field_value
+            validate_field_binding! field_binding, field_value
             field_value = field_value.split("/").map { |segment| percent_escape segment }.join("/")
           end
 
@@ -124,6 +126,43 @@ module Gapic
         end
       end
 
+      # Validates a user-supplied parameter value bound to a standard (*) or path (**) URI template variable
+      # to prevent directory traversal exploits.
+      #
+      # @param field_binding [HttpBinding::FieldBinding] The field binding template metadata.
+      # @param field_value [String] The parameter value to validate.
+      # @raise [Gapic::Common::Error] If validation fails.
+      def validate_field_binding! field_binding, field_value
+        validate_path_binding! field_binding, field_value
+      end
+
+      # Validates standard (*) and path (**) parameters by ensuring that no segment in the parameter
+      # value is a directory traversal segment (. or ..).
+      #
+      # Validation Mechanism:
+      # 1. Splits the parameter value by slash (`/`) using `-1` limit to preserve all segments.
+      # 2. Checks each segment. If any segment matches `.` or `..`, it immediately raises
+      #    a `Gapic::Common::Error`, aborting the request.
+      # 3. Empty segments (e.g. duplicate slashes `//` or trailing slashes `/`) are allowed
+      #    by this validator and passed to the server, which handles normalization or returns 400.
+      #
+      # @param field_binding [HttpBinding::FieldBinding] The field binding template metadata.
+      # @param field_value [String] The parameter value to validate.
+      # @raise [Gapic::Common::Error] If validation fails.
+      def validate_path_binding! field_binding, field_value
+        segments = field_value.split("/", -1)
+        segments.each do |segment|
+          next unless [".", ".."].include? segment
+          if field_binding.preserve_slashes
+            raise ::Gapic::Common::Error,
+                  "Value for #{field_binding.field_path} must not contain segments that are exactly '#{segment}'."
+          else
+            raise ::Gapic::Common::Error,
+                  "Invalid value for #{field_binding.field_path} '#{segment}'."
+          end
+        end
+      end
+
       # Percent-escapes a string.
       # @param str [String] String to escape.
       # @return [String] Escaped string.

data/lib/gapic/rest/resumable_upload/core.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require "gapic/rest/resumable_upload/data_types"
+require "gapic/rest/resumable_upload/rules"
+
+module Gapic
+  module Rest
+    module ResumableUpload
+      ##
+      # @private
+      # State machine container holding the immutable State snapshot.
+      # Contains zero protocol branching logic and zero side-effects.
+      #
+      # The middle tier of the three-tier design: `Driver` executes side effects, {Rules} decides transitions,
+      # and Core holds the {State} between the two. See {Rules} for the protocol narrative and state graph, and
+      # `design/resumable_upload/implementation-guide.md` section 1 for the tier boundaries.
+      #
+      class Core
+        # @private
+        # @return [State] Current immutable state snapshot
+        attr_reader :state
+
+        # @private
+        # @return [Decision, nil] Decision emitted during the last dispatch
+        attr_reader :last_decision
+
+        ##
+        # @private
+        # Initializes a Core state machine container.
+        #
+        # @param config [StartUploadConfig, ResumeUploadConfig] Upload session configuration
+        #
+        def initialize config
+          @config = config
+          @last_decision = nil
+          @state = State.new(
+            status:            :initializing,
+            upload_url:        nil,
+            offset:            0,
+            chunk_size:        config.chunk_size || Rules::DEFAULT_CHUNK_SIZE,
+            chunk_granularity: nil,
+            in_flight_length:  0,
+            last_error:        nil
+          )
+        end
+
+        ##
+        # @private
+        # Dispatches event to Rules and updates internal state snapshot.
+        #
+        # @param event [Object] Input event
+        # @return [Array<Object>] Driver instructions
+        #
+        def dispatch event
+          decision = Rules.decide @state, event, @config
+          @state = decision.next_state
+          @last_decision = decision
+          decision.instructions
+        end
+      end
+    end
+  end
+end