Skip to content

Quote user_id literals in VertexAiSessionService list filters#5273

Open
petrmarinec wants to merge 2 commits intogoogle:mainfrom
petrmarinec:fix-vertex-session-filter-escaping
Open

Quote user_id literals in VertexAiSessionService list filters#5273
petrmarinec wants to merge 2 commits intogoogle:mainfrom
petrmarinec:fix-vertex-session-filter-escaping

Conversation

@petrmarinec
Copy link
Copy Markdown

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

2. Or, if no issue exists, describe the change:

Problem:
VertexAiSessionService.list_sessions() built an AIP-160 filter by interpolating raw user_id into a quoted string literal. Embedded quotes could break out of that literal and append additional filter syntax.

Solution:
Quote the user_id value before constructing the filter string so embedded quotes and backslashes stay inside the literal. Added a regression test that captures the exact filter passed to the Vertex client for a quote-containing payload.

Testing Plan

Unit Tests:

  • I have added or updated unit tests for my change.
  • All unit tests pass locally.

Passed locally:

  • PYTHONPATH=src pytest tests/unittests/sessions/test_vertex_ai_session_service.py
    • Result: 29 passed

Passed in clean Linux Docker (python:3.11-bookworm):

  • pip install -e '.[test]'
  • PYTHONPATH=src pytest tests/unittests/sessions
    • Result: 170 passed

Manual Validation:

  • On current origin/main, a payload of attacker" OR user_id!="" produced the filter string user_id="attacker" OR user_id!="".
  • On this branch, the same payload produces user_id="attacker\" OR user_id!=\"\"", keeping the metacharacters inside the quoted literal.

Checklist

  • I have read the CONTRIBUTING.md document.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have added tests that prove my fix is effective or that my feature works.
  • New and existing unit tests pass locally with my changes.
  • I have manually tested my changes end-to-end.
  • Any dependent changes have been merged and published in downstream modules.

Additional context

This is a small, focused fix that keeps the current filter construction approach but ensures user_id values remain data instead of altering the filter expression.

@adk-bot adk-bot added the services [Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc label Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

services [Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants