[Bug]: REST task/request id sanitization

Open Beginner friendly
#805 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
python
Domain
backend-api-design, security

Research direction

Look for the REST transport code, likely in a file like rest.py or transport/rest.py. Find where the URL path /v1/tasks/{request.id} is constructed. Sanitize the request.id to prevent path traversal (e.g., by removing / or ..). Check for existing tests related to the REST transport to understand the expected behavior and add a test for the sanitization.

Written by the indexing model from the issue text.

Description

maintainers-only
What happened?

In rest transport we use f'/v1/tasks/{request.id}'
request.id in theory can contain ../../ or other substrings.

Relevant log output
Code of Conduct
  • I agree to follow this project's Code of Conduct
Dominant language
Python
Stars
2.2k
Forks
496
Avg merge
1d 23h
Merged PRs (30d)
16

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from a2aproject/a2a-python

All issues in a2aproject/a2a-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.