google-apis-core 1.2.5 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 496e7d887e5cfdbe739f62370d447dc9d663352a6385ab89e7bc7aa75f58d391
-  data.tar.gz: d68a12cee717e901edd3f1092dbe338f1692c0ccaba75408096ed5a05256eecf
+  metadata.gz: 3732fd02580bd217827d1301e1737b4cf816324234980a06892e12f74970cbf5
+  data.tar.gz: ed2a0068e67097f5fe2bf39f80f382d27440bd479e5843df8995d5c85a61112a
 SHA512:
-  metadata.gz: 01423b834b7449a7824b35a64bda7e31df896e0a40a5084217ff52186d467cbea8d3d2359475ebd5d0b7d3bc0585fbfaef1682965b72195262ef591c2ef8a5e9
-  data.tar.gz: 53f83a8ed0557d57939c017bd5910e98d38e0211a25053f79ecf5ddfd528000d5382f8347769529f182263f4d2089ec371d1c575481e0070cef94051c29673c9
+  metadata.gz: f4216e6c22892a88e775a7210e2d2be785f6dacff4c5c53f43ede511124b0429117ec95dd92da9d546ab3e922205be2d678a69add9fda4f0cafa53a7108b05e0
+  data.tar.gz: d143809acffb08f0a09662825fbe733f33eae474dc16d40a72db64a34cf0d359a3ccb4584221d4dfb5b8e137775af23d31d47d84168d7097feca3c5af3c01e8c

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Release History
 
+### 1.3.0 (2026-10-04)
+
+#### Features
+
+* implement path validation and traversal checks in HttpCommand ([#27476](https://github.com/googleapis/google-api-ruby-client/issues/27476)) 
+
 ### 1.2.5 (2026-07-20)
 
 #### Bug Fixes

data/lib/google/apis/core/http_command.rb

@@ -31,7 +31,7 @@ module Google
         RETRIABLE_ERRORS = [Google::Apis::ServerError,
                             Google::Apis::RateLimitError,
                             Google::Apis::TransmissionError,
-                            Google::Apis::RequestTimeOutError]
+                            Google::Apis::RequestTimeOutError].freeze
 
         begin
           require 'opencensus'
@@ -83,15 +83,15 @@ module Google
           self.url = url
           self.url = Addressable::Template.new(url) if url.is_a?(String)
           self.method = method
-          self.header = Hash.new
+          self.header = {}
           self.body = body
           self.query = {}
           self.params = {}
           @opencensus_span = nil
           if OPENCENSUS_AVAILABLE
             logger.warn  'OpenCensus support is now deprecated. ' +
-                         'Please refer https://github.com/googleapis/google-api-ruby-client#tracing for migrating to use OpenTelemetry.' 
-            
+                         'Please refer https://github.com/googleapis/google-api-ruby-client#tracing for migrating to use OpenTelemetry.'
+
           end
         end
 
@@ -114,34 +114,30 @@ module Google
           release!
         end
 
-        def do_retry func, client
-          begin
-            Retriable.retriable tries: options.retries + 1,
-                                max_elapsed_time: options.max_elapsed_time,
-                                base_interval: options.base_interval,
-                                max_interval: options.max_interval,
-                                multiplier: options.multiplier,
-                                on: RETRIABLE_ERRORS do |try|
-              # This 2nd level retriable only catches auth errors, and supports 1 retry, which allows
-              # auth to be re-attempted without having to retry all sorts of other failures like
-              # NotFound, etc
-              auth_tries = (try == 1 && authorization_refreshable? ? 2 : 1)
-              Retriable.retriable tries: auth_tries,
-                                  on: [Google::Apis::AuthorizationError, Signet::AuthorizationError, Signet::RemoteServerError, Signet::UnexpectedStatusError],
-                                  on_retry: proc { |*| refresh_authorization } do
-                send(func, client).tap do |result|
-                  if block_given?
-                    yield result, nil
-                  end
-                end
+        def do_retry(func, client)
+          Retriable.retriable tries: options.retries + 1,
+                              max_elapsed_time: options.max_elapsed_time,
+                              base_interval: options.base_interval,
+                              max_interval: options.max_interval,
+                              multiplier: options.multiplier,
+                              on: RETRIABLE_ERRORS do |try|
+            # This 2nd level retriable only catches auth errors, and supports 1 retry, which allows
+            # auth to be re-attempted without having to retry all sorts of other failures like
+            # NotFound, etc
+            auth_tries = (try == 1 && authorization_refreshable? ? 2 : 1)
+            Retriable.retriable tries: auth_tries,
+                                on: [Google::Apis::AuthorizationError, Signet::AuthorizationError, Signet::RemoteServerError, Signet::UnexpectedStatusError],
+                                on_retry: proc { |*| refresh_authorization } do
+              send(func, client).tap do |result|
+                yield result, nil if block_given?
               end
             end
-          rescue => e
-            if block_given?
-              yield nil, e
-            else
-              raise e
-            end
+          end
+        rescue StandardError => e
+          if block_given?
+            yield nil, e
+          else
+            raise e
           end
         end
 
@@ -164,6 +160,7 @@ module Google
         #
         # @private
         # @return [void]
+        # @raise [Google::Apis::ClientError] If path parameter validation fails.
         def prepare!
           normalize_unicode = true
           if options
@@ -171,7 +168,10 @@ module Google
             query.update(options.query) if options.query
             normalize_unicode = options.normalize_unicode
           end
-          self.url = url.expand(params, nil, normalize_unicode) if url.is_a?(Addressable::Template)
+          if url.is_a?(Addressable::Template)
+            validate_path_parameters!
+            self.url = encode_reserved_parameters(url, normalize_unicode).expand(params, nil, normalize_unicode)
+          end
           url.query_values = normalize_query_values(query).merge(url.query_values || {})
 
           if allow_form_encoding?
@@ -182,17 +182,16 @@ module Google
             @form_encoded = false
           end
 
-          self.body = '' if self.body.nil? && [:post, :put, :patch].include?(method)
+          self.body = '' if self.body.nil? && %i[post put patch].include?(method)
           if defined?(::Google::Apis::Core::CompositeIO) && body.is_a?(::Google::Apis::Core::CompositeIO)
-            header["Content-Length"] ||= body.size.to_s
+            header['Content-Length'] ||= body.size.to_s
           end
         end
 
         # Release any resources used by this command
         # @private
         # @return [void]
-        def release!
-        end
+        def release!; end
 
         # Check the response and either decode body or raise error
         #
@@ -298,7 +297,7 @@ module Google
             err = Google::Apis::TransmissionError.new(err)
           end
           block.call(nil, err) if block_given?
-          fail err if rethrow || block.nil?
+          raise err if rethrow || block.nil?
         end
 
         # Execute the command once.
@@ -323,7 +322,7 @@ module Google
             logger.debug { safe_single_line_representation @http_res }
             response = process_response(@http_res.status.to_i, @http_res.headers, @http_res.body)
             success(response)
-          rescue => e
+          rescue StandardError => e
             logger.debug { sprintf('Caught error %s', e) }
             error(e, rethrow: true)
           end
@@ -343,28 +342,33 @@ module Google
         end
 
         def allow_form_encoding?
-          [:post, :put].include?(method) && body.nil?
+          %i[post put].include?(method) && body.nil?
         end
 
         # Set the API version header for the service if not empty.
         # @return [void]
-        def set_api_version_header api_version
+        def set_api_version_header(api_version)
           self.header['X-Goog-Api-Version'] = api_version unless api_version.empty?
         end
 
         private
 
         UNSAFE_CLASS_NAMES = [
-          "Google::Apis::CloudkmsV1::DecryptResponse",
-          "Google::Apis::SecretmanagerV1::SecretPayload",
-          "Google::Apis::SecretmanagerV1beta1::SecretPayload"
-        ]
+          'Google::Apis::CloudkmsV1::DecryptResponse',
+          'Google::Apis::SecretmanagerV1::SecretPayload',
+          'Google::Apis::SecretmanagerV1beta1::SecretPayload'
+        ].freeze
+
+        # Matches the two URI template expressions Discovery documents use: simple ({var})
+        # and reserved ({+var}). Group 1 is '+' for reserved expansion, group 2 the name.
+        TEMPLATE_VAR_PATTERN = /\{(\+?)(\w+)\}/.freeze
 
         module RedactingPPMethods
-          def pp_object obj
+          def pp_object(obj)
             return super unless UNSAFE_CLASS_NAMES.include? obj.class.name
+
             object_address_group obj do
-              text "(fields redacted)"
+              text '(fields redacted)'
             end
           end
         end
@@ -377,16 +381,16 @@ module Google
           include RedactingPPMethods
         end
 
-        def safe_pretty_representation obj
-          out = +""
+        def safe_pretty_representation(obj)
+          out = +''
           printer = RedactingPP.new out, 79
           printer.guard_inspect_key { printer.pp obj }
           printer.flush
           out << "\n"
         end
 
-        def safe_single_line_representation obj
-          out = +""
+        def safe_single_line_representation(obj)
+          out = +''
           printer = RedactingSingleLine.new out
           printer.guard_inspect_key { printer.pp obj }
           printer.flush
@@ -400,9 +404,9 @@ module Google
 
           @opencensus_span = OpenCensus::Trace.start_span url.path.to_s
           @opencensus_span.kind = OpenCensus::Trace::SpanBuilder::CLIENT
-          @opencensus_span.put_attribute "http.host", url.host.to_s
-          @opencensus_span.put_attribute "http.method", method.to_s.upcase
-          @opencensus_span.put_attribute "http.path", url.path.to_s
+          @opencensus_span.put_attribute 'http.host', url.host.to_s
+          @opencensus_span.put_attribute 'http.method', method.to_s.upcase
+          @opencensus_span.put_attribute 'http.path', url.path.to_s
           sent_size =
             if body.respond_to? :bytesize
               body.bytesize
@@ -436,7 +440,7 @@ module Google
             status = @http_res.status.to_i
             if status > 0
               @opencensus_span.set_status map_http_status status
-              @opencensus_span.put_attribute "http.status_code", status
+              @opencensus_span.put_attribute 'http.status_code', status
             end
           end
 
@@ -452,7 +456,7 @@ module Google
           @form_encoded
         end
 
-        def map_http_status http_status
+        def map_http_status(http_status)
           case http_status
           when 200..399 then 0 # OK
           when 400 then 3 # INVALID_ARGUMENT
@@ -468,9 +472,8 @@ module Google
         end
 
         def normalize_query_values(input)
-          input.inject({}) do |h, (k, v)|
+          input.each_with_object({}) do |(k, v), h|
             h[k] = normalize_query_value(v)
-            h
           end
         end
 
@@ -484,6 +487,96 @@ module Google
             v.to_s
           end
         end
+
+        # Validates user-supplied path parameter values against the URL template specification
+        # to prevent directory traversal and parameter injection exploits.
+        #
+        # Validation rejects only dot segments. Other characters are percent-encoded instead.
+        #
+        # Validation Mechanism:
+        # 1. For simple variables ({var}, standard single-wildcard behavior):
+        #    - Rejects if the value is exactly '.' or '..'.
+        #    - Reserved characters such as '/', '?' and '#' are percent-encoded by Addressable.
+        # 2. For reserved variables ({+var}, double-wildcard behavior):
+        #    - Splits the value by slash ('/') and rejects any segment that is exactly '.' or '..'.
+        #    - Every character except '/' and unreserved characters is percent-encoded by
+        #      #encode_reserved_parameters.
+        #
+        # @raise [Google::Apis::ClientError] If any validation check fails.
+        def validate_path_parameters!
+          template_pattern = url.pattern
+
+          variables = template_pattern.scan(TEMPLATE_VAR_PATTERN).map do |operator, var_name|
+            { name: var_name, reserved: operator == '+' }
+          end
+
+          variables.each do |v|
+            var_name = v[:name]
+            var_key = params.key?(var_name) ? var_name : var_name.to_sym
+            next unless params.key?(var_key)
+
+            value = params[var_key].to_s
+
+            if v[:reserved]
+              value.split('/').each do |seg|
+                if ['.', '..'].include?(seg)
+                  raise Google::Apis::ClientError,
+                        "Value for #{var_name} must not contain segments that are exactly '#{seg}'."
+                end
+              end
+            elsif ['.', '..'].include?(value)
+              raise Google::Apis::ClientError,
+                    "Invalid value for #{var_name} '#{value}'."
+            end
+          end
+        end
+
+        # Substitutes percent-encoded values for reserved ({+var}) variables in the template.
+        #
+        # Addressable leaves reserved characters such as '+', ':', '?' and '#' literal in a
+        # reserved expansion, so they would reach the server unencoded. Only '/' and unreserved
+        # characters should stay literal, so these values are encoded here and written into the
+        # template's literal text, which Addressable passes through untouched when it expands
+        # the rest.
+        #
+        # @param [Addressable::Template] template
+        #   The URL template.
+        # @param [Boolean] normalize_unicode
+        #   Whether to apply Unicode NFC normalization to the values.
+        # @return [Addressable::Template]
+        #   A template with reserved variables replaced by their encoded values.
+        def encode_reserved_parameters(template, normalize_unicode)
+          pattern = template.pattern.dup
+          template.pattern.scan(TEMPLATE_VAR_PATTERN).each do |operator, var_name|
+            next unless operator == '+'
+
+            var_key = params.key?(var_name) ? var_name : var_name.to_sym
+            next unless params.key?(var_key)
+
+            # The encoded value contains no braces, so the new pattern parses cleanly and the
+            # value cannot introduce a template expression of its own.
+            pattern = pattern.gsub("{+#{var_name}}", encode_reserved_value(params[var_key], normalize_unicode))
+          end
+          Addressable::Template.new(pattern)
+        end
+
+        # Percent-encodes every character except '/' and unreserved characters.
+        #
+        # @param [Object] value
+        #   The parameter value.
+        # @param [Boolean] normalize_unicode
+        #   Whether to apply Unicode NFC normalization to the value.
+        # @return [String]
+        #   The encoded value.
+        def encode_reserved_value(value, normalize_unicode)
+          value = value.to_s
+          # Addressable only normalizes values left in the mapping, so normalize here to match.
+          value = value.unicode_normalize(:nfc) if normalize_unicode
+          # Split on '/' and keep empty segments (-1), so slashes stay literal.
+          # Each segment is then fully encoded, including '%' itself (as '%25').
+          unreserved = Addressable::URI::CharacterClasses::UNRESERVED
+          value.split('/', -1).map { |segment| Addressable::URI.encode_component(segment, unreserved) }.join('/')
+        end
       end
     end
   end

data/lib/google/apis/core/version.rb

@@ -16,7 +16,7 @@ module Google
   module Apis
     module Core
       # Core version
-      VERSION = "1.2.5".freeze
+      VERSION = "1.3.0".freeze
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: google-apis-core
 version: !ruby/object:Gem::Version
-  version: 1.2.5
+  version: 1.3.0
 platform: ruby
 authors:
 - Google LLC
@@ -167,7 +167,7 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/googleapis/google-api-ruby-client/issues
   changelog_uri: https://github.com/googleapis/google-api-ruby-client/tree/main/google-apis-core/CHANGELOG.md
-  documentation_uri: https://googleapis.dev/ruby/google-apis-core/v1.2.5
+  documentation_uri: https://googleapis.dev/ruby/google-apis-core/v1.3.0
   source_code_uri: https://github.com/googleapis/google-api-ruby-client/tree/main/google-apis-core
 rdoc_options: []
 require_paths: