shreemaan-abhishek opened a new pull request, #14154:
URL: https://github.com/apache/apisix/pull/14154
### Description
A path parameter fills one segment of an operation's path, but
`build_path()` put the
caller's value into the path as given once percent-encoded, and then sent
the result to
`base_url`. Percent-encoding does not make a value a single segment:
* `.` and `..` are unreserved, so they survive encoding untouched and reach
the API as
dot segments. A call to a tool generated from `GET /items/{id}` with `id`
set to `..`
sends `/items/../`, which the server receiving it resolves to `/`, so the
call lands on
a path the operation does not describe.
* A slash is sent as `%2F`, which a server that accepts an encoded separator
decodes back
into a separator, with the same result.
* An empty value leaves `//` in the path, which a server that merges slashes
collapses.
A path parameter whose value is empty, `.` or `..`, or that contains a slash
or a
backslash, now fails the call with `isError` set, the same way any other
argument that
cannot be sent does. `handler.call()` returns `nil` plus a message for that
case and
`handle_tools_call()` reports it with the existing input-validation wording.
#### Which issue(s) this PR fixes:
N/A
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
A document that relied on a slash inside a path parameter to address a
nested path now
gets an error instead. That shape was already served inconsistently: the
value went out
as `%2F`, so whether it addressed a nested path or a single segment
containing a literal
slash depended on the server at the other end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
