Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

RestApiTool path parameters with '.' / '..' still reach the wire after quote(safe="")

已关闭
  • 哪里不对？
#7,065 4 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 5 天内回复

@sanketpatil06 已经在做这个了。

开始于 2026年9月9日。

评估

这个 Issue 还没有评估数据。

描述

tools

🔴 Required Information

Describe the Bug:
RestApiTool (google.adk.tools.openapi_tool) percent-encodes path parameter values with urllib.parse.quote(value, safe="") and documents that this prevents a model-supplied value from redirecting the request onto an undeclared path on the same host.

That guarantee does not hold for RFC 3986 dot-segments. quote() never encodes . (it is unreserved), so a value containing .. is sent with literal dot-dot segments joined by encoded slashes. Backends/gateways that decode %2F and then merge dot-segments can dispatch the request — with the tool's configured credentials — to a path the OpenAPI spec never declared.

>>> from urllib.parse import quote
>>> quote("../../admin/secret", safe="")
'..%2F..%2Fadmin%2Fsecret'

This is a hardening follow-up to the merged encoding fix (25f53bd). Google VRP issue 557701521 was closed as Infeasible (not tracked as a security bug) with a request to file this publicly.

Steps to Reproduce:

  1. Use an OpenAPI spec that declares only GET /files/{name} against a host that also serves an undeclared route such as GET /admin/secret.
  2. Call the generated tool with args={"name": "../../admin/secret"}.
  3. Observe the outgoing request line GET /files/..%2F..%2Fadmin%2Fsecret.
  4. On a backend that decodes %2F then merges dot-segments (e.g. a Go router over path.Clean(r.URL.Path), nginx as a gateway), the undeclared /admin/secret body is returned as the tool result.

Expected Behavior:
Path parameters whose /- or \-separated segments are . or .. are rejected before any HTTP request is sent. quote(safe="") continues to encode /, ?, and #. Slash-containing IDs such as foo/bar remain encoded as foo%2Fbar.

Observed Behavior:
The client emits GET /files/..%2F..%2Fadmin%2Fsecret. httpx correctly treats %2F as data, so the dot-dot sequences reach the backend unchanged.

Environment Details:

  • ADK Library Version (pip show google-adk): 2.8.0 (a119dd7751082dbbd9a65f71e359abdc2be659cc)
  • Desktop OS: macOS
  • Python Version (python -V): 3.12 / 3.13

Model Information:

  • Are you using LiteLLM: N/A (library-level RestApiTool)
  • Which model is being used: N/A

🟡 Optional Information

Regression:
Present in any release that contains the quote(safe="") path-param encoding fix.

Minimal Reproduction Code:

from urllib.parse import quote
print(quote("../../admin/secret", safe=""))  # '..%2F..%2Fadmin%2Fsecret'

Additional Context:

Backend behavior for GET /files/..%2F..%2Fadmin%2Fsecret:

  • Hand-rolled Go routers that clean the decoded path (path.Clean(r.URL.Path)): request is dispatched to /admin/secret.
  • Legacy Go ServeMux (pre-1.22 / GODEBUG=httpmuxgo121=1): 301 to /admin/secret. ADK does not follow redirects; a following intermediary would complete the access.
  • Modern Go ServeMux (>= 1.22), FastAPI/Starlette direct, Envoy defaults: not affected (%2F stays one segment).
  • nginx as gateway: decode-and-merge by documented analysis.

Same host/port only (origin is fixed by the spec). Suggested client-side fix: reject . / .. as path segments, then keep quote(safe="").

主要语言
Python
星标
21.6k
派生
4k
平均合并
9 小时 59 分钟
30 天内合并 PR
5

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

google/adk-python 的其他 Issue

查看 google/adk-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。