fix: validate path parameters and prevent traversal/injection in REST transcoder - tests relocated - #9166
Merged
danieljbruce merged 9 commits intoAug 18, 2026
Conversation
… in REST…" This reverts commit 0152a8e.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request introduces formatting updates to the transcoding module and its tests, along with a change in how the Dialogflow CX package is imported in tests. The feedback advises against using a dynamically computed path in the require() statement of the validation tests, suggesting a constant string literal instead to maintain compatibility with bundlers and runtime environments.
…into revert-9151-transcoding-path-traversal-fix-reintroduction # Conflicts: # core/packages/gax/src/transcoding.ts # core/packages/gax/test/unit/transcoding.ts # core/packages/gax/test/unit/transcoding_validation.ts
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
…on' of https://github.com/googleapis/google-cloud-node into revert-9151-transcoding-path-traversal-fix-reintroduction
danieljbruce
marked this pull request as ready for review
August 18, 2026 20:41
westarle
approved these changes
Aug 18, 2026
westarle
left a comment
westarle
left a comment
Contributor
There was a problem hiding this comment.
If this is a clean rollforward of the previous PR with test change it LGTM.
|
|
||
| import * as assert from 'assert'; | ||
| import { describe, it } from 'mocha'; | ||
| const { v3 } = require('../../../../../../packages/google-cloud-dialogflow-cx'); |
Contributor
There was a problem hiding this comment.
This seems brittle to me; is there a place that has visibility to both packages? If not, we might want to introduce one. Can you file a ticket to track this (moving this to another directory where the dependencies can be a bit more natural -- maybe reuse your 'de-skip' issue)
Contributor
Author
There was a problem hiding this comment.
danieljbruce
enabled auto-merge (squash)
August 18, 2026 20:57
danieljbruce
deleted the
revert-9151-transcoding-path-traversal-fix-reintroduction
branch
August 18, 2026 21:32
Merged
danieljbruce
added a commit
that referenced
this pull request
Aug 21, 2026
…ry request encodings (#9181) ## Description #9166 resolves a vulnerability for Gapic client libraries, but that same vulnerability exists for apiary libraries which this pull request patches. While this change is not on the apiary library, it is a change for the nodejs-googleapis-common package which all the apiary libraries use to do their requests. ## Impact Removes the potential for an exploit on apiary libraries. ## Important Notes About Code Changes 1. All the methods in core/packages/nodejs-googleapis-common/src/transcoding.ts except validateAndEncodeParams and extractTemplateParams are exact duplicates of the methods in google-gax. It was important to reuse a lot of this logic so that we only have to scrutinize new code that was necessary due to the differences between apiary and gapic clients. 2. Tests are applied against createAPIRequest to capture the gax equivalent of both * and ** wildcards as well as all special characters. 3. To verify that apiary actually uses this code, apiary library tests are provided in core/packages/nodejs-googleapis-common/test/test.dialogflow.ts that explain what apiary passes into createAPIRequest so that we can understand how the code works end to end. ## Next Steps 1. With this pull request we now have duplicate code like applyPattern in gax and common. We should find one place for this code to live and reference that place from both libraries. 2. The pull request removed the normalizePathParams method from this PR to keep it small in 9b02fe8 commit. However, we should add this method in again to improve code quality. 3. Swap "require.cache[commonPath] =" out when the new changes are released for this client library to avoid a hacky mock. Tracked [here](https://b.corp.google.com/issues/549714508)
danieljbruce
pushed a commit
that referenced
this pull request
Aug 24, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>gapic-generator: 5.1.0</summary> ## [5.1.0](gapic-generator-v5.0.1...gapic-generator-v5.1.0) (2026-08-20) ### Features * **o11y:** Introduce observability flags needed within the generator ([#9052](#9052)) ([849708b](849708b)) </details> <details><summary>google-gax: 6.0.3</summary> ## [6.0.3](google-gax-v6.0.2...google-gax-v6.0.3) (2026-08-20) ### Bug Fixes * Validate path parameters and prevent traversal/injection in REST transcoder - tests relocated ([#9166](#9166)) ([8a2b491](8a2b491)) * Validate path parameters and prevent traversal/injection in REST transcoder ([#9151](#9151)) ([0152a8e](0152a8e)) </details> <details><summary>gaxios: 8.0.0</summary> ## [8.0.0](gaxios-v7.3.1...gaxios-v8.0.0) (2026-08-20) ### ⚠ BREAKING CHANGES * Update gaxios to minimum Node version of 22. ([#9172](#9172)) ### Features * Update gaxios to minimum Node version of 22. ([#9172](#9172)) ([20f9fbd](20f9fbd)) </details> <details><summary>precise-date: 6.0.1</summary> ## [6.0.1](precise-date-v6.0.0...precise-date-v6.0.1) (2026-08-20) ### Bug Fixes * **precise-date:** Support TypeScript 7 ([#9115](#9115)) ([1cdce29](1cdce29)) </details> <details><summary>admanager: 0.10.0</summary> ## [0.10.0](admanager-v0.9.0...admanager-v0.10.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>chat: 0.30.0</summary> ## [0.30.0](chat-v0.29.0...chat-v0.30.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>aiplatform: 7.2.0</summary> ## [7.2.0](aiplatform-v7.1.0...aiplatform-v7.2.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>alloydb: 3.1.0</summary> ## [3.1.0](alloydb-v3.0.0...alloydb-v3.1.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>auditmanager: 0.3.0</summary> ## [0.3.0](auditmanager-v0.2.0...auditmanager-v0.3.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>bigquery-reservation: 5.1.0</summary> ## [5.1.0](bigquery-reservation-v5.0.0...bigquery-reservation-v5.1.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>google-cloud-bigquery-storage-api: 0.4.0</summary> ## [0.4.0](google-cloud-bigquery-storage-api-v0.3.0...google-cloud-bigquery-storage-api-v0.4.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>google-cloud-bigtable-api: 0.4.0</summary> ## [0.4.0](google-cloud-bigtable-api-v0.3.0...google-cloud-bigtable-api-v0.4.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>dataform: 3.2.0</summary> ## [3.2.0](dataform-v3.1.0...dataform-v3.2.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>dialogflow-cx: 6.0.1</summary> ## [6.0.1](dialogflow-cx-v6.0.0...dialogflow-cx-v6.0.1) (2026-08-20) ### Bug Fixes * Validate path parameters and prevent traversal/injection in REST transcoder ([#9151](#9151)) ([0152a8e](0152a8e)) </details> <details><summary>ftp: 0.1.0</summary> ## 0.1.0 (2026-08-20) ### Features * **google/cloud/ftp/v1:** Onboard a new library ([#9147](#9147)) ([6317bd9](6317bd9)) ### Bug Fixes * Update ftp config ([#9156](#9156)) ([ea818ba](ea818ba)) </details> <details><summary>oracledatabase: 0.10.0</summary> ## [0.10.0](oracledatabase-v0.9.0...oracledatabase-v0.10.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>recaptcha-enterprise: 7.1.0</summary> ## [7.1.0](recaptcha-enterprise-v7.0.0...recaptcha-enterprise-v7.1.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>retail: 5.1.0</summary> ## [5.1.0](retail-v5.0.1...retail-v5.1.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>publicca: 3.1.0</summary> ## [3.1.0](publicca-v3.0.0...publicca-v3.1.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>support: 3.1.0</summary> ## [3.1.0](support-v3.0.0...support-v3.1.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>vectorsearch: 0.10.0</summary> ## [0.10.0](vectorsearch-v0.9.0...vectorsearch-v0.10.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> <details><summary>workloadidentity: 0.1.0</summary> ## 0.1.0 (2026-08-20) ### Features * **google/cloud/workloadidentity/v1:** Onboard a new library ([#9143](#9143)) ([7a22218](7a22218)) ### Bug Fixes * **workloadidentity:** Update release level to preview ([#9161](#9161)) ([69829c9](69829c9)), refs [#9096](#9096) </details> <details><summary>developer-knowledge: 0.5.0</summary> ## [0.5.0](developer-knowledge-v0.4.0...developer-knowledge-v0.5.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>health: 0.6.0</summary> ## [0.6.0](health-v0.5.0...health-v0.6.0) (2026-08-20) ### Features * Update sources and regenerate ([#9170](#9170)) ([827fab0](827fab0)) </details> <details><summary>cloudbuild: 6.1.0</summary> ## [6.1.0](cloudbuild-v6.0.0...cloudbuild-v6.1.0) (2026-08-20) ### Features * Update API sources and regenerate ([#9140](#9140)) ([863bc96](863bc96)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Reintroduces changes #9151 only with the tests relocated not to conflict with generated changes.
Impact
Resolves the exploit.