Skip to content

fix: validate URI template variables against dot segments - #2194

Closed
blakeli0 wants to merge 1 commit into
googleapis:mainfrom
blakeli0:fix/uri-template-dot-segments
Closed

blakeli0 wants to merge 1 commit into
googleapis:mainfrom
blakeli0:fix/uri-template-dot-segments

Conversation

@blakeli0

Copy link
Copy Markdown
Contributor

Validates URI template variable values during UriTemplate expansion to reject dot segments ("." and "..") that could cause unintended URI path traversal:

  • Reject values equal to "." or ".." in simple string ({var}) expansions (IllegalArgumentException: "Invalid value %s for %s.").
  • Reject any "/"-delimited segment equal to "." or ".." in reserved ({+var}) expansions (IllegalArgumentException: "Value for %s must not contain segments that are exactly . or ..").

@blakeli0
blakeli0 requested a review from a team as a code owner October 12, 2026 18:11
@product-auto-label product-auto-label Bot added the size: m Pull request size is medium. label Oct 12, 2026
@blakeli0 blakeli0 closed this Oct 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size: m Pull request size is medium.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant