kit_api 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4996d89da108c8784c235ec730e4d2b4137701d41c1942dfa3e6020d0f7c692e
-  data.tar.gz: 95b2e1edd7d2f15effd72df4d75804202a6685b82e08fcd35f485b51219d4f63
+  metadata.gz: 8f29211b6943cfb1833bac057c9a467348e82209f61a466c0cc7185807196061
+  data.tar.gz: ddfd7c72c09e317fb691feb3886eb7f3d2333eaf3cd70b1559e43716625e1bc5
 SHA512:
-  metadata.gz: '070426945ce384b443242bc1f72fe3546449fc5bfb05cde203b9bffe62177bdcf82992c5537a79e4881ad70cf0319429bae37f702921067bd35fc3eabb232364'
-  data.tar.gz: 77670b26e8ec2cfd5006e18560f93e69b27199ef2edcd4f2ec2fb5be0cd329218be354b26ae1fc1b47090793e2e8e987375cacd78daddf37ca8c96a520ca4d79
+  metadata.gz: 46dd4f5676a5ce60556a5e03a59128b48902359b0409519047273e6b11bb55fd0b2cc27cc71776a7317de6c764e37c2c9b1cf7e7c50135170686be0edb78afc9
+  data.tar.gz: 49eda611a1c29fdf030e071594713cf1a3d40628fa5fcd8dc056b8c2db5931439df14a922d93776cf3ea27c5800940712fdf7e4f729ddd464b87d12f9281d8f5

data/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 
-## 0.1.0 — Unreleased
+## 0.1.1 — Unreleased
+
+- Security: URL-escape ids interpolated into request paths, so a hostile
+  id like `"42/unsubscribe"` can no longer splice the request into a
+  different endpoint.
+
+## 0.1.0 — 2026-09-26
 
 - Initial release: full Kit v4 API surface (subscribers, tags, custom fields,
   forms, sequences, sequence emails, broadcasts, account, purchases, segments,

data/lib/kit/client/broadcasts.rb

@@ -8,7 +8,7 @@ module Kit
       end
 
       def broadcast(id)
-        request(:get, "/broadcasts/#{id}")
+        request(:get, "/broadcasts/#{esc(id)}")
       end
 
       # send_at: nil leaves it a draft; subscriber_filter targets tags/segments.
@@ -17,15 +17,15 @@ module Kit
       end
 
       def update_broadcast(id, **attributes)
-        request(:put, "/broadcasts/#{id}", body: attributes)
+        request(:put, "/broadcasts/#{esc(id)}", body: attributes)
       end
 
       def delete_broadcast(id)
-        request(:delete, "/broadcasts/#{id}")
+        request(:delete, "/broadcasts/#{esc(id)}")
       end
 
       def broadcast_stats(id)
-        request(:get, "/broadcasts/#{id}/stats")
+        request(:get, "/broadcasts/#{esc(id)}/stats")
       end
 
       # Filters: sent_after/before, status.
@@ -34,7 +34,7 @@ module Kit
       end
 
       def broadcast_clicks(id, **params)
-        request(:get, "/broadcasts/#{id}/clicks", params: params)
+        request(:get, "/broadcasts/#{esc(id)}/clicks", params: params)
       end
     end
   end

data/lib/kit/client/custom_fields.rb

@@ -12,11 +12,11 @@ module Kit
       end
 
       def update_custom_field(id, label:)
-        request(:put, "/custom_fields/#{id}", body: { label: label })
+        request(:put, "/custom_fields/#{esc(id)}", body: { label: label })
       end
 
       def delete_custom_field(id)
-        request(:delete, "/custom_fields/#{id}")
+        request(:delete, "/custom_fields/#{esc(id)}")
       end
 
       def bulk_create_custom_fields(custom_fields, callback_url: nil)

data/lib/kit/client/forms.rb

@@ -8,14 +8,14 @@ module Kit
       end
 
       def form_subscribers(id, **params)
-        request(:get, "/forms/#{id}/subscribers", params: params)
+        request(:get, "/forms/#{esc(id)}/subscribers", params: params)
       end
 
       def add_subscriber_to_form(form_id, email_address: nil, subscriber_id: nil, referrer: nil)
         if subscriber_id
-          request(:post, "/forms/#{form_id}/subscribers/#{subscriber_id}", body: { referrer: referrer }.compact)
+          request(:post, "/forms/#{esc(form_id)}/subscribers/#{esc(subscriber_id)}", body: { referrer: referrer }.compact)
         else
-          request(:post, "/forms/#{form_id}/subscribers",
+          request(:post, "/forms/#{esc(form_id)}/subscribers",
             body: { email_address: email_address, referrer: referrer }.compact)
         end
       end

data/lib/kit/client/posts.rb

@@ -8,7 +8,7 @@ module Kit
       end
 
       def post(id)
-        request(:get, "/posts/#{id}")
+        request(:get, "/posts/#{esc(id)}")
       end
     end
   end

data/lib/kit/client/purchases.rb

@@ -8,7 +8,7 @@ module Kit
       end
 
       def purchase(id)
-        request(:get, "/purchases/#{id}")
+        request(:get, "/purchases/#{esc(id)}")
       end
 
       # OAuth only. An existing transaction_id appends products instead of duplicating.

data/lib/kit/client/sequences.rb

@@ -8,7 +8,7 @@ module Kit
       end
 
       def sequence(id)
-        request(:get, "/sequences/#{id}")
+        request(:get, "/sequences/#{esc(id)}")
       end
 
       def create_sequence(name:, **attributes)
@@ -16,44 +16,44 @@ module Kit
       end
 
       def update_sequence(id, **attributes)
-        request(:put, "/sequences/#{id}", body: attributes)
+        request(:put, "/sequences/#{esc(id)}", body: attributes)
       end
 
       def delete_sequence(id)
-        request(:delete, "/sequences/#{id}")
+        request(:delete, "/sequences/#{esc(id)}")
       end
 
       def sequence_subscribers(id, **params)
-        request(:get, "/sequences/#{id}/subscribers", params: params)
+        request(:get, "/sequences/#{esc(id)}/subscribers", params: params)
       end
 
       def add_subscriber_to_sequence(sequence_id, email_address: nil, subscriber_id: nil)
         if subscriber_id
-          request(:post, "/sequences/#{sequence_id}/subscribers/#{subscriber_id}")
+          request(:post, "/sequences/#{esc(sequence_id)}/subscribers/#{esc(subscriber_id)}")
         else
-          request(:post, "/sequences/#{sequence_id}/subscribers", body: { email_address: email_address })
+          request(:post, "/sequences/#{esc(sequence_id)}/subscribers", body: { email_address: email_address })
         end
       end
 
       def sequence_emails(sequence_id, **params)
-        request(:get, "/sequences/#{sequence_id}/emails", params: params)
+        request(:get, "/sequences/#{esc(sequence_id)}/emails", params: params)
       end
 
       def sequence_email(sequence_id, id)
-        request(:get, "/sequences/#{sequence_id}/emails/#{id}")
+        request(:get, "/sequences/#{esc(sequence_id)}/emails/#{esc(id)}")
       end
 
       def create_sequence_email(sequence_id, subject:, delay_value:, delay_unit:, **attributes)
-        request(:post, "/sequences/#{sequence_id}/emails",
+        request(:post, "/sequences/#{esc(sequence_id)}/emails",
           body: { subject: subject, delay_value: delay_value, delay_unit: delay_unit, **attributes })
       end
 
       def update_sequence_email(sequence_id, id, **attributes)
-        request(:put, "/sequences/#{sequence_id}/emails/#{id}", body: attributes)
+        request(:put, "/sequences/#{esc(sequence_id)}/emails/#{esc(id)}", body: attributes)
       end
 
       def delete_sequence_email(sequence_id, id)
-        request(:delete, "/sequences/#{sequence_id}/emails/#{id}")
+        request(:delete, "/sequences/#{esc(sequence_id)}/emails/#{esc(id)}")
       end
     end
   end

data/lib/kit/client/snippets.rb

@@ -8,7 +8,7 @@ module Kit
       end
 
       def snippet(id)
-        request(:get, "/snippets/#{id}")
+        request(:get, "/snippets/#{esc(id)}")
       end
 
       # snippet_type: "inline" takes content:; "block" takes document_attributes:.
@@ -17,7 +17,7 @@ module Kit
       end
 
       def update_snippet(id, **attributes)
-        request(:put, "/snippets/#{id}", body: attributes)
+        request(:put, "/snippets/#{esc(id)}", body: attributes)
       end
     end
   end

data/lib/kit/client/subscribers.rb

@@ -10,7 +10,7 @@ module Kit
       end
 
       def subscriber(id)
-        request(:get, "/subscribers/#{id}")
+        request(:get, "/subscribers/#{esc(id)}")
       end
 
       # Upserts: an existing email_address gets its first_name updated.
@@ -19,11 +19,11 @@ module Kit
       end
 
       def update_subscriber(id, **attributes)
-        request(:put, "/subscribers/#{id}", body: attributes)
+        request(:put, "/subscribers/#{esc(id)}", body: attributes)
       end
 
       def unsubscribe_subscriber(id)
-        request(:post, "/subscribers/#{id}/unsubscribe")
+        request(:post, "/subscribers/#{esc(id)}/unsubscribe")
       end
 
       def bulk_create_subscribers(subscribers, callback_url: nil)
@@ -31,23 +31,23 @@ module Kit
       end
 
       def subscriber_stats(id, **params)
-        request(:get, "/subscribers/#{id}/stats", params: params)
+        request(:get, "/subscribers/#{esc(id)}/stats", params: params)
       end
 
       def subscriber_tags(id, **params)
-        request(:get, "/subscribers/#{id}/tags", params: params)
+        request(:get, "/subscribers/#{esc(id)}/tags", params: params)
       end
 
       def pin_subscriber_location(id, **location)
-        request(:post, "/subscribers/#{id}/location", body: { location: location })
+        request(:post, "/subscribers/#{esc(id)}/location", body: { location: location })
       end
 
       def update_subscriber_location(id, **location)
-        request(:patch, "/subscribers/#{id}/location", body: { location: location })
+        request(:patch, "/subscribers/#{esc(id)}/location", body: { location: location })
       end
 
       def delete_subscriber_location(id)
-        request(:delete, "/subscribers/#{id}/location")
+        request(:delete, "/subscribers/#{esc(id)}/location")
       end
     end
   end

data/lib/kit/client/tags.rb

@@ -12,26 +12,26 @@ module Kit
       end
 
       def update_tag(id, name:)
-        request(:put, "/tags/#{id}", body: { name: name })
+        request(:put, "/tags/#{esc(id)}", body: { name: name })
       end
 
       def tag_subscribers(id, **params)
-        request(:get, "/tags/#{id}/subscribers", params: params)
+        request(:get, "/tags/#{esc(id)}/subscribers", params: params)
       end
 
       def tag_subscriber(tag_id, email_address: nil, subscriber_id: nil)
         if subscriber_id
-          request(:post, "/tags/#{tag_id}/subscribers/#{subscriber_id}")
+          request(:post, "/tags/#{esc(tag_id)}/subscribers/#{esc(subscriber_id)}")
         else
-          request(:post, "/tags/#{tag_id}/subscribers", body: { email_address: email_address })
+          request(:post, "/tags/#{esc(tag_id)}/subscribers", body: { email_address: email_address })
         end
       end
 
       def untag_subscriber(tag_id, email_address: nil, subscriber_id: nil)
         if subscriber_id
-          request(:delete, "/tags/#{tag_id}/subscribers/#{subscriber_id}")
+          request(:delete, "/tags/#{esc(tag_id)}/subscribers/#{esc(subscriber_id)}")
         else
-          request(:delete, "/tags/#{tag_id}/subscribers", params: { email_address: email_address })
+          request(:delete, "/tags/#{esc(tag_id)}/subscribers", params: { email_address: email_address })
         end
       end
 

data/lib/kit/client/webhooks.rb

@@ -8,7 +8,7 @@ module Kit
       end
 
       def webhook(id)
-        request(:get, "/webhook_endpoints/#{id}")
+        request(:get, "/webhook_endpoints/#{esc(id)}")
       end
 
       # The signing secret comes back in plaintext only on this response.
@@ -17,19 +17,19 @@ module Kit
       end
 
       def update_webhook(id, **attributes)
-        request(:put, "/webhook_endpoints/#{id}", body: attributes)
+        request(:put, "/webhook_endpoints/#{esc(id)}", body: attributes)
       end
 
       def delete_webhook(id)
-        request(:delete, "/webhook_endpoints/#{id}")
+        request(:delete, "/webhook_endpoints/#{esc(id)}")
       end
 
       def rotate_webhook_secret(id, force: nil)
-        request(:post, "/webhook_endpoints/#{id}/rotate_secret", body: { force: force }.compact)
+        request(:post, "/webhook_endpoints/#{esc(id)}/rotate_secret", body: { force: force }.compact)
       end
 
       def revoke_previous_webhook_secret(id)
-        request(:post, "/webhook_endpoints/#{id}/revoke_previous_secret")
+        request(:post, "/webhook_endpoints/#{esc(id)}/revoke_previous_secret")
       end
     end
   end

data/lib/kit/client.rb

@@ -62,6 +62,10 @@ module Kit
     end
 
     private
+      # Ids land in URL paths; escaping keeps a hostile "42/unsubscribe"
+      # from splicing itself into a different endpoint.
+      def esc(id) = URI.encode_www_form_component(id.to_s)
+
       def tag_id(name)
         @tag_ids ||= {}
         @tag_ids[name] ||= begin

data/lib/kit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kit
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kit_api
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Mike D