line-bot-api 2.8.0 → 2.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f023fd6c0f958541a976719fb3adb8538746ee19397136b370bbb6165fb6a86b
-  data.tar.gz: 99660df7df0c5bb83449d688ab5f8f8b8e8a422a3046d214f64a288317a6e24c
+  metadata.gz: 6ad02a20005fee8a0e8d623b055e9e6f4990470078091977ff5fe975a859e648
+  data.tar.gz: 68f57f3c95489ed50f9b025360fb2a64405dd2007a713867a29b7d571d1e9438
 SHA512:
-  metadata.gz: f295390c9f9084fdc15775f775bbb885fc09587abb216bb6d8ed63ae00ad00cf63b237ffd5d5c98de9ad77c6c1c68e6e60a25be3dd9fa2557868f7ac6beeaefe
-  data.tar.gz: d3b1d62f2bf36242fc42f43a9f24ff736cdffcb3616d111d7df34288456390aad7827dea5e2cb5108a46b81e997566386f8749b9761a267da08507e168965c5e
+  metadata.gz: c619d6ee8fec6ce8414106ed4307efbdbb1b932a8bcb5de22a21d36e51dea1c4587ce8f9c3f31d0b0efb150896468c906b258f7b4ba594fd5399bc62e9a9c1f4
+  data.tar.gz: 1981d17b472554726c2855f8b2e89efadc015c5de854a001ca701d45b8ce5c23da0fd0d1733db59c3e16867e12bfb22afc88cbcadf6e93f077c369b9a4e9f460

data/lib/line/bot/v2/liff/api/liff_client.rb

@@ -115,8 +115,9 @@ module Line
           def delete_liff_app_with_http_info( 
             liff_id:
           )
-            path = "/liff/v1/apps/{liffId}"
-              .gsub(/{liffId}/, liff_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/liff/v1/apps/{liffId}", {
+              "liffId": liff_id
+            })
 
             response = @http_client.delete(
               path: path,
@@ -221,8 +222,9 @@ module Line
             liff_id:, 
             update_liff_app_request:
           )
-            path = "/liff/v1/apps/{liffId}"
-              .gsub(/{liffId}/, liff_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/liff/v1/apps/{liffId}", {
+              "liffId": liff_id
+            })
 
             response = @http_client.put(
               path: path,

data/lib/line/bot/v2/manage_audience/api/manage_audience_client.rb

@@ -247,8 +247,9 @@ module Line
           def delete_audience_group_with_http_info( 
             audience_group_id:
           )
-            path = "/v2/bot/audienceGroup/{audienceGroupId}"
-              .gsub(/{audienceGroupId}/, audience_group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/audienceGroup/{audienceGroupId}", {
+              "audienceGroupId": audience_group_id
+            })
 
             response = @http_client.delete(
               path: path,
@@ -292,8 +293,9 @@ module Line
           def get_audience_data_with_http_info( 
             audience_group_id:
           )
-            path = "/v2/bot/audienceGroup/{audienceGroupId}"
-              .gsub(/{audienceGroupId}/, audience_group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/audienceGroup/{audienceGroupId}", {
+              "audienceGroupId": audience_group_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -432,8 +434,9 @@ module Line
           def get_shared_audience_data_with_http_info( 
             audience_group_id:
           )
-            path = "/v2/bot/audienceGroup/shared/{audienceGroupId}"
-              .gsub(/{audienceGroupId}/, audience_group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/audienceGroup/shared/{audienceGroupId}", {
+              "audienceGroupId": audience_group_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -573,8 +576,9 @@ module Line
             audience_group_id:, 
             update_audience_group_description_request:
           )
-            path = "/v2/bot/audienceGroup/{audienceGroupId}/updateDescription"
-              .gsub(/{audienceGroupId}/, audience_group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/audienceGroup/{audienceGroupId}/updateDescription", {
+              "audienceGroupId": audience_group_id
+            })
 
             response = @http_client.put(
               path: path,

data/lib/line/bot/v2/messaging_api/api/messaging_api_blob_client.rb

@@ -56,8 +56,9 @@ module Line
           def get_message_content_with_http_info( 
             message_id:
           )
-            path = "/v2/bot/message/{messageId}/content"
-              .gsub(/{messageId}/, message_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/message/{messageId}/content", {
+              "messageId": message_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -100,8 +101,9 @@ module Line
           def get_message_content_preview_with_http_info( 
             message_id:
           )
-            path = "/v2/bot/message/{messageId}/content/preview"
-              .gsub(/{messageId}/, message_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/message/{messageId}/content/preview", {
+              "messageId": message_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -144,8 +146,9 @@ module Line
           def get_message_content_transcoding_by_message_id_with_http_info( 
             message_id:
           )
-            path = "/v2/bot/message/{messageId}/content/transcoding"
-              .gsub(/{messageId}/, message_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/message/{messageId}/content/transcoding", {
+              "messageId": message_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -193,8 +196,9 @@ module Line
           def get_rich_menu_image_with_http_info( 
             rich_menu_id:
           )
-            path = "/v2/bot/richmenu/{richMenuId}/content"
-              .gsub(/{richMenuId}/, rich_menu_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/{richMenuId}/content", {
+              "richMenuId": rich_menu_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -239,8 +243,9 @@ module Line
             rich_menu_id:, 
             body:
           )
-            path = "/v2/bot/richmenu/{richMenuId}/content"
-              .gsub(/{richMenuId}/, rich_menu_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/{richMenuId}/content", {
+              "richMenuId": rich_menu_id
+            })
 
             response = @http_client.post(
               path: path,

data/lib/line/bot/v2/messaging_api/api/messaging_api_client.rb

@@ -186,8 +186,9 @@ module Line
           def close_coupon_with_http_info( 
             coupon_id:
           )
-            path = "/v2/bot/coupon/{couponId}/close"
-              .gsub(/{couponId}/, coupon_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/coupon/{couponId}/close", {
+              "couponId": coupon_id
+            })
 
             response = @http_client.put(
               path: path,
@@ -414,8 +415,9 @@ module Line
           def delete_rich_menu_with_http_info( 
             rich_menu_id:
           )
-            path = "/v2/bot/richmenu/{richMenuId}"
-              .gsub(/{richMenuId}/, rich_menu_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/{richMenuId}", {
+              "richMenuId": rich_menu_id
+            })
 
             response = @http_client.delete(
               path: path,
@@ -459,8 +461,9 @@ module Line
           def delete_rich_menu_alias_with_http_info( 
             rich_menu_alias_id:
           )
-            path = "/v2/bot/richmenu/alias/{richMenuAliasId}"
-              .gsub(/{richMenuAliasId}/, rich_menu_alias_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/alias/{richMenuAliasId}", {
+              "richMenuAliasId": rich_menu_alias_id
+            })
 
             response = @http_client.delete(
               path: path,
@@ -657,8 +660,9 @@ module Line
           def get_coupon_detail_with_http_info( 
             coupon_id:
           )
-            path = "/v2/bot/coupon/{couponId}"
-              .gsub(/{couponId}/, coupon_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/coupon/{couponId}", {
+              "couponId": coupon_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -823,8 +827,9 @@ module Line
           def get_group_member_count_with_http_info( 
             group_id:
           )
-            path = "/v2/bot/group/{groupId}/members/count"
-              .gsub(/{groupId}/, group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/group/{groupId}/members/count", {
+              "groupId": group_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -874,9 +879,10 @@ module Line
             group_id:, 
             user_id:
           )
-            path = "/v2/bot/group/{groupId}/member/{userId}"
-              .gsub(/{groupId}/, group_id.to_s)
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/group/{groupId}/member/{userId}", {
+              "groupId": group_id,
+              "userId": user_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -929,8 +935,9 @@ module Line
             group_id:, 
             start: nil
           )
-            path = "/v2/bot/group/{groupId}/members/ids"
-              .gsub(/{groupId}/, group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/group/{groupId}/members/ids", {
+              "groupId": group_id
+            })
             query_params = {
               "start": start
             }.compact
@@ -985,8 +992,9 @@ module Line
           def get_group_summary_with_http_info( 
             group_id:
           )
-            path = "/v2/bot/group/{groupId}/summary"
-              .gsub(/{groupId}/, group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/group/{groupId}/summary", {
+              "groupId": group_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -1040,8 +1048,9 @@ module Line
             start: nil, 
             limit: nil
           )
-            path = "/v2/bot/membership/{membershipId}/users/ids"
-              .gsub(/{membershipId}/, membership_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/membership/{membershipId}/users/ids", {
+              "membershipId": membership_id
+            })
             query_params = {
               "start": start,
               "limit": limit
@@ -1170,8 +1179,9 @@ module Line
           def get_membership_subscription_with_http_info( 
             user_id:
           )
-            path = "/v2/bot/membership/subscription/{userId}"
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/membership/subscription/{userId}", {
+              "userId": user_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -1633,8 +1643,9 @@ module Line
           def get_profile_with_http_info( 
             user_id:
           )
-            path = "/v2/bot/profile/{userId}"
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/profile/{userId}", {
+              "userId": user_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -1682,8 +1693,9 @@ module Line
           def get_rich_menu_with_http_info( 
             rich_menu_id:
           )
-            path = "/v2/bot/richmenu/{richMenuId}"
-              .gsub(/{richMenuId}/, rich_menu_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/{richMenuId}", {
+              "richMenuId": rich_menu_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -1731,8 +1743,9 @@ module Line
           def get_rich_menu_alias_with_http_info( 
             rich_menu_alias_id:
           )
-            path = "/v2/bot/richmenu/alias/{richMenuAliasId}"
-              .gsub(/{richMenuAliasId}/, rich_menu_alias_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/alias/{richMenuAliasId}", {
+              "richMenuAliasId": rich_menu_alias_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -1875,8 +1888,9 @@ module Line
           def get_rich_menu_id_of_user_with_http_info( 
             user_id:
           )
-            path = "/v2/bot/user/{userId}/richmenu"
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/user/{userId}/richmenu", {
+              "userId": user_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -1967,8 +1981,9 @@ module Line
           def get_room_member_count_with_http_info( 
             room_id:
           )
-            path = "/v2/bot/room/{roomId}/members/count"
-              .gsub(/{roomId}/, room_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/room/{roomId}/members/count", {
+              "roomId": room_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -2018,9 +2033,10 @@ module Line
             room_id:, 
             user_id:
           )
-            path = "/v2/bot/room/{roomId}/member/{userId}"
-              .gsub(/{roomId}/, room_id.to_s)
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/room/{roomId}/member/{userId}", {
+              "roomId": room_id,
+              "userId": user_id
+            })
 
             response = @http_client.get(
               path: path,
@@ -2073,8 +2089,9 @@ module Line
             room_id:, 
             start: nil
           )
-            path = "/v2/bot/room/{roomId}/members/ids"
-              .gsub(/{roomId}/, room_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/room/{roomId}/members/ids", {
+              "roomId": room_id
+            })
             query_params = {
               "start": start
             }.compact
@@ -2172,8 +2189,9 @@ module Line
           def issue_link_token_with_http_info( 
             user_id:
           )
-            path = "/v2/bot/user/{userId}/linkToken"
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/user/{userId}/linkToken", {
+              "userId": user_id
+            })
 
             response = @http_client.post(
               path: path,
@@ -2223,8 +2241,9 @@ module Line
           def leave_group_with_http_info( 
             group_id:
           )
-            path = "/v2/bot/group/{groupId}/leave"
-              .gsub(/{groupId}/, group_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/group/{groupId}/leave", {
+              "groupId": group_id
+            })
 
             response = @http_client.post(
               path: path,
@@ -2283,8 +2302,9 @@ module Line
           def leave_room_with_http_info( 
             room_id:
           )
-            path = "/v2/bot/room/{roomId}/leave"
-              .gsub(/{roomId}/, room_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/room/{roomId}/leave", {
+              "roomId": room_id
+            })
 
             response = @http_client.post(
               path: path,
@@ -2329,9 +2349,10 @@ module Line
             user_id:, 
             rich_menu_id:
           )
-            path = "/v2/bot/user/{userId}/richmenu/{richMenuId}"
-              .gsub(/{userId}/, user_id.to_s)
-              .gsub(/{richMenuId}/, rich_menu_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/user/{userId}/richmenu/{richMenuId}", {
+              "userId": user_id,
+              "richMenuId": rich_menu_id
+            })
 
             response = @http_client.post(
               path: path,
@@ -3036,8 +3057,9 @@ module Line
           def set_default_rich_menu_with_http_info( 
             rich_menu_id:
           )
-            path = "/v2/bot/user/all/richmenu/{richMenuId}"
-              .gsub(/{richMenuId}/, rich_menu_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/user/all/richmenu/{richMenuId}", {
+              "richMenuId": rich_menu_id
+            })
 
             response = @http_client.post(
               path: path,
@@ -3226,8 +3248,9 @@ module Line
           def unlink_rich_menu_id_from_user_with_http_info( 
             user_id:
           )
-            path = "/v2/bot/user/{userId}/richmenu"
-              .gsub(/{userId}/, user_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/user/{userId}/richmenu", {
+              "userId": user_id
+            })
 
             response = @http_client.delete(
               path: path,
@@ -3317,8 +3340,9 @@ module Line
             rich_menu_alias_id:, 
             update_rich_menu_alias_request:
           )
-            path = "/v2/bot/richmenu/alias/{richMenuAliasId}"
-              .gsub(/{richMenuAliasId}/, rich_menu_alias_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/richmenu/alias/{richMenuAliasId}", {
+              "richMenuAliasId": rich_menu_alias_id
+            })
 
             response = @http_client.post(
               path: path,

data/lib/line/bot/v2/module/api/line_module_client.rb

@@ -58,8 +58,9 @@ module Line
             chat_id:, 
             acquire_chat_control_request: nil
           )
-            path = "/v2/bot/chat/{chatId}/control/acquire"
-              .gsub(/{chatId}/, chat_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/chat/{chatId}/control/acquire", {
+              "chatId": chat_id
+            })
 
             response = @http_client.post(
               path: path,
@@ -208,8 +209,9 @@ module Line
           def release_chat_control_with_http_info( 
             chat_id:
           )
-            path = "/v2/bot/chat/{chatId}/control/release"
-              .gsub(/{chatId}/, chat_id.to_s)
+            path = Line::Bot::V2::Utils.build_path("/v2/bot/chat/{chatId}/control/release", {
+              "chatId": chat_id
+            })
 
             response = @http_client.post(
               path: path,

data/lib/line/bot/v2/utils.rb

@@ -1,3 +1,5 @@
+require 'uri'
+
 module Line
   module Bot
     module V2
@@ -8,6 +10,29 @@ module Line
         #       breaking change that does not allow Hash requests will be necessary.
         NO_CAMELIZE_PARENT_KEYS = %w(substitution).freeze
 
+        # Matches a path that contains a "." or ".." segment (literal or percent-encoded),
+        # so a path parameter cannot escape its endpoint. See square/retrofit's RequestBuilder for the same idea.
+        PATH_TRAVERSAL = %r{\A(?:.*/)?(?:\.|%2e|%2E){1,2}(?:/.*)?\z}.freeze
+
+        # NOTE: line-bot-sdk-ruby users should not use this. Breaking changes may occur, so use at your own risk.
+        #
+        # Substitutes path parameters into a path template and rejects any
+        # result that would let a parameter perform path traversal.
+        def self.build_path(path_template, params)
+          path = path_template
+          params.each do |name, value|
+            raise ArgumentError, "#{name} is required" if value.nil?
+
+            path = path.gsub("{#{name}}", URI.encode_uri_component(value.to_s))
+          end
+
+          if PATH_TRAVERSAL.match?(path)
+            raise ArgumentError, "Path parameters shouldn't perform path traversal ('.' or '..'): #{path}"
+          end
+
+          path
+        end
+
         # NOTE: line-bot-sdk-ruby users should not use this. Breaking changes may occur, so use at your own risk.
         def self.deep_underscore(hash)
           hash.each_with_object({}) do |(key, value), result| # steep:ignore UnannotatedEmptyCollection

data/lib/line/bot/version.rb

@@ -2,6 +2,6 @@ module Line
   module Bot
     # This version is updated before releasing a new version in the release process.
     # You don't have to update this version manually.
-    VERSION = "2.8.0"
+    VERSION = "2.8.1"
   end
 end

data/sig/line/bot/v2/utils.rbs

@@ -4,6 +4,10 @@ module Line
       module Utils
         NO_CAMELIZE_PARENT_KEYS: Array[String]
 
+        PATH_TRAVERSAL: Regexp
+
+        def self.build_path: (String, Hash[Symbol, untyped]) -> String
+
         def self.deep_underscore: (Hash[untyped, untyped]) -> Hash[Symbol, untyped]
 
         def self.deep_symbolize: (untyped) -> untyped

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: line-bot-api
 version: !ruby/object:Gem::Version
-  version: 2.8.0
+  version: 2.8.1
 platform: ruby
 authors:
 - LINE Corporation