fix: validate path parameters and prevent traversal/injection in REST transcoder by danieljbruce · Pull Request #9151 · googleapis/google-cloud-node

danieljbruce · 2026-08-14T18:50:21Z

Description

Protect GAPIC REST clients from path traversal and parameter injection exploits with two mechanisms:

Percent encodes special characters to ensure intended operations like reads can't become writes etc.
Throws an error when .. or . characters are used for path traversal. This differs depending on whether the * or ** wildcard is used. For * throws an error when exact matches are made with . and .. . For ** throws an error when the placeholder includes . or .. between slashes.

Impact

Improves the security of our clients by preventing exploits.

Testing

It should be noted that some new tests in packages/google-cloud-dialogflow-cx/test/transcoding_validation.ts were skipped because they fail in the CI pipeline. This is because they pass with these changes, but these changes are to gax and google-cloud-dialogflow-cx does not get this version of gax yet until it is published.

To test locally:
cd packages/google-cloud-dialogflow-cx
pnpm link ../../core/packages/gax
npm run compile && npx mocha build/test/transcoding_validation.js

Transcoding tests are also added which provide support for ** wildcard which the dialogflow-cx tests can't cover.

Additional Info

I identified a refactor in https://github.com/googleapis/google-cloud-node/pull/9150/changes which should be worth considering to improve readability.

It should also be noted that googleapis/ruby-core-libraries#67 was done for Ruby which has differences that may vary from language to language.

…back To prevent directory traversal and reserved-character injection attacks in fallback HTTP/REST transport, this commit implements the strict transcoding validation guidelines: 1. Rejects single-asterisk (*) matches resolving exactly to '.' or '..' with error: 'Invalid value {value} for {propertyName}'. 2. Rejects double-asterisk (**) matches containing segments exactly '.' or '..' with error: 'Value for {propertyName} must not contain segments that are exactly . or ..'. 3. Percent-encodes all variable segments except unreserved [-__.~/0-9a-zA-Z], ensuring characters like '!', ''', '(', ')', and '*' are encoded. 4. Filters out null and undefined values in buildQueryStringComponents array serialization to prevent TypeErrors. 5. Guards optional unmatched groups in applyPattern. Includes a rigorous suite of 10 tests using the google-cloud-dialogflow-cx library to verify these mitigations in action. Co-authored-by: danieljbruce <8935272+danieljbruce@users.noreply.github.com>

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

…870442' of https://github.com/googleapis/google-cloud-node into jules-transcoding-path-traversal-vuln-fix-6401005213542870442

…ath" This reverts commit 94095ab.

This reverts commit c898db0.

…path" This reverts commit d33163b.

…rse the path"" This reverts commit ca4f260.

This reverts commit ea99463.

This reverts commit d875be0.

… transcoder

…oogleapis/google-cloud-node into transcoding-path-traversal-fix

gemini-code-assist

Code Review

This pull request introduces path traversal validation and strict RFC 3986 percent-encoding to the transcoding logic in gax, along with corresponding unit and integration tests. The reviewer feedback highlights a potential application crash (URIError: URI malformed) when processing non-BMP characters (such as emojis) due to splitting strings by UTF-16 code units with str.split('') instead of using the spread operator [...str]. Additionally, there is an unused import of the path module in the new test file that should be removed.

gemini-code-assist · 2026-08-14T18:52:43Z

  return str
    .split('')
-    .map(c => (c.match(/[-_.~0-9a-zA-Z]/) ? c : encodeURIComponent(c)))
+    .map(c => (c.match(/[-_.~0-9a-zA-Z]/) ? c : strictEncodeURIComponent(c)))
    .join('');


Using str.split('') splits the string by UTF-16 code units. If the input string contains any characters outside the Basic Multilingual Plane (BMP) (such as emojis or certain Han characters), split('') will break them into unpaired surrogates. When these unpaired surrogates are passed to encodeURIComponent (inside strictEncodeURIComponent), it will throw a URIError: URI malformed and crash the application.

Using the spread operator [...str] correctly iterates over Unicode code points, preserving surrogate pairs as single characters, which avoids the URIError and correctly percent-encodes them.

return [...str] .map(c => (c.match(/[-_.~0-9a-zA-Z]/) ? c : strictEncodeURIComponent(c))) .join('');

gemini-code-assist · 2026-08-14T18:52:43Z

  return str
    .split('')
-    .map(c => (c.match(/[-_.~0-9a-zA-Z/]/) ? c : encodeURIComponent(c)))
+    .map(c => (c.match(/[-_.~0-9a-zA-Z/]/) ? c : strictEncodeURIComponent(c)))
    .join('');


Using str.split('') splits the string by UTF-16 code units. If the input string contains any characters outside the Basic Multilingual Plane (BMP) (such as emojis or certain Han characters), split('') will break them into unpaired surrogates. When these unpaired surrogates are passed to encodeURIComponent (inside strictEncodeURIComponent), it will throw a URIError: URI malformed and crash the application.

Using the spread operator [...str] correctly iterates over Unicode code points, preserving surrogate pairs as single characters, which avoids the URIError and correctly percent-encodes them.

return [...str] .map(c => (c.match(/[-_.~0-9a-zA-Z/]/) ? c : strictEncodeURIComponent(c))) .join('');

gemini-code-assist · 2026-08-14T18:52:43Z

+import * as assert from 'assert';
+import { describe, it } from 'mocha';
+import { v3 } from '../src';
+import * as path from 'path';


The path module is imported but never used in this test file. It should be removed to keep the code clean and avoid potential linter warnings.

westarle · 2026-08-14T20:27:08Z


+// Validates a single path segment matched by a single wildcard (*).
+// Checks that the segment is not exactly '.' or '..' (directory traversal indicators).
+function validateSingleSegment(propertyName: string, value: string): void {


How about validateUriPathSegment?

westarle · 2026-08-14T20:27:24Z

+// Splitting by slash, it checks that no individual segment is exactly '.' or '..'.
+// This segment-by-segment check prevents directory traversal while allowing
+// legitimate resource names containing dots (e.g., domain-scoped project IDs).
+function validateMultiSegment(propertyName: string, value: string): void {


and validateUriPath

westarle · 2026-08-14T20:32:58Z

+
+  // Test 1: Single Asterisk Dot Validation on client call
+  it.skip('1. should throw an error for single-asterisk segment traversal using exactly "." as session ID', async () => {
+    // TODO: Re-enable this test when the gax version with the new encoding is released.


can you file an issue for re-enabling the tests?

Yup. Already did here.

westarle · 2026-08-14T20:34:25Z

+  it('applyPattern should percent-encode query injection attempt on double-asterisk without throwing traversal error', () => {
+    const res = applyPattern(
+      'projects/*/locations/*/agents/*/sessions/**',
+      'projects/p/locations/l/agents/a/sessions/..?$httpMethod=DELETE#',


please use a less instructive parameter like "?$foo=BAR#"

westarle · 2026-08-14T20:44:07Z

-    .split('')
-    .map(c => (c.match(/[-_.~0-9a-zA-Z]/) ? c : encodeURIComponent(c)))
+  return [...str]
+    .map(c => (c.match(/[-_.~0-9a-zA-Z]/) ? c : strictEncodeURIComponent(c)))


is the character iteration necessary anymore or can you just call strictEncodeURIComponent? I think it preserves the same chars now!

westarle · 2026-08-14T20:46:00Z

-    .split('')
-    .map(c => (c.match(/[-_.~0-9a-zA-Z/]/) ? c : encodeURIComponent(c)))
+  return [...str]
+    .map(c => (c.match(/[-_.~0-9a-zA-Z/]/) ? c : strictEncodeURIComponent(c)))


to avoid character iteration here, you'll need to do something like strictEncodeURIComponent(c, /* preserveSlashes: boolean = false = */ true)

westarle · 2026-08-14T20:51:08Z

+  );
+}
+
 export function encodeWithSlashes(str: string): string {


while you're here, can you please document these exported functions?

It took me a while to understand the point of With- and WithoutSlashes.

google-labs-jules Bot and others added 24 commits August 13, 2026 18:03

Apply suggestions from code review

0e1f219

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Add a comment about changing the applyPattern signature

ebd4779

Merge branch 'jules-transcoding-path-traversal-vuln-fix-6401005213542…

9759c50

…870442' of https://github.com/googleapis/google-cloud-node into jules-transcoding-path-traversal-vuln-fix-6401005213542870442

Move the transcoding tests

70c928d

Move the wildcards definition to later

ae95e73

Add another test with the exact pattern

08d13b0

Adjust the code to fail when the user tries to traverse the path

94095ab

Revert "Adjust the code to fail when the user tries to traverse the p…

d33163b

…ath" This reverts commit 94095ab.

Add comments to the last test

c898db0

Revert "Add comments to the last test"

ea99463

This reverts commit c898db0.

Reapply "Adjust the code to fail when the user tries to traverse the …

ca4f260

…path" This reverts commit d33163b.

Revert "Reapply "Adjust the code to fail when the user tries to trave…

af94646

…rse the path"" This reverts commit ca4f260.

Reapply "Add comments to the last test"

89c693f

This reverts commit ea99463.

Add another comment about percent encoding

3e46c57

Add two tests for transversal

fcc25cc

Add comment for encoding using slashes

94131e5

revert buildQueryStringComponents changes

e600bb3

Add strictEncodeURIComponent wrapper method

db33841

Add method comments

2336449

Add more notes about character preservation

38506c6

Add the pnpm lock file

d875be0

Revert "Add the pnpm lock file"

5c6ad6d

This reverts commit d875be0.

skip the tests because gax is not released yet.

23097b9

danieljbruce changed the title ~~Transcoding path traversal fix~~ fix: validate path parameters and prevent traversal/injection in REST transcoder- #67 Aug 14, 2026

danieljbruce changed the title ~~fix: validate path parameters and prevent traversal/injection in REST transcoder- #67~~ fix: validate path parameters and prevent traversal/injection in REST transcoder Aug 14, 2026

danieljbruce added 2 commits August 14, 2026 14:51

fix: validate path parameters and prevent traversal/injection in REST…

a967001

… transcoder

Merge branch 'transcoding-path-traversal-fix' of https://github.com/g…

fe620b0

…oogleapis/google-cloud-node into transcoding-path-traversal-fix

gemini-code-assist Bot reviewed Aug 14, 2026

View reviewed changes

Replace with [...str]

fe2c259

danieljbruce added 2 commits August 14, 2026 15:30

Add tests for the spread operator

be19de3

remove unused import

1746c32

danieljbruce requested a review from westarle August 14, 2026 19:42

danieljbruce marked this pull request as ready for review August 14, 2026 19:44

danieljbruce requested a review from a team as a code owner August 14, 2026 19:44

westarle reviewed Aug 14, 2026

View reviewed changes

Uh oh!

Conversation

danieljbruce commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Impact

Testing

Additional Info

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

danieljbruce commented Aug 14, 2026 •

edited

Loading