fix: REST fallback path traversal and parameter injection fix

[danieljbruce]

Description

This PR fixes a path traversal vulnerability in the gRPC-to-HTTP transcoding layer of google-gax. Specifically, it updates the encodeWithSlashes and encodeWithoutSlashes methods in src/transcoding.ts to explicitly percent-encode double-dot sequences (..) as %2E%2E. By doing this, we ensure that url inputs are safely converted.

Proper encoding of other potentially dangerous characters—such as ? and # which could cause parameter injection—is already handled correctly by encodeURIComponent within the existing pipeline (as these characters do not match the safe regex list). This is demonstrated by the newly added assert statements which verify that characters like ?, $, and # successfully encode to %3F, %24, and %23 respectively.

Impact

By implementing this fix centrally in the google-gax core library, we immediately secure the REST fallback transport for all downstream Google Cloud client libraries against path traversal and parameter injection vulnerabilities.

Additionally, because we are specifically targeting double dots (..) rather than encoding all single dot characters (.), we ensure strict backward compatibility. Existing applications and unit tests that expect a single dot to remain unencoded will continue to function without any breaking changes.

Testing

• Added assertions for all characters we want to avoid.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request updates the transcoding utility functions encodeWithSlashes and encodeWithoutSlashes to explicitly encode dot (.) characters as %2E to prevent path traversal and parameter injection. It also adds corresponding unit tests. The review feedback highlights redundant and overly complex ternary expressions in the newly added tests that compare identical string literals, suggesting they be simplified to direct string literals.

[gemini-code-assist]

This ternary expression is redundant and unnecessarily complex because it compares a string literal to itself. It can be simplified to a direct string literal.

Suggested change

	('_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ%2F%20').toLowerCase() ===
	('_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ%2F%20').toLowerCase()
	? '_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ%2F%20'
	: ''
	'_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ%2F%20'

[danieljbruce]

This change was undone in favor of adding assert statements only.

[gemini-code-assist]

This ternary expression is redundant and unnecessarily complex because it compares a string literal to itself. It can be simplified to a direct string literal.

Suggested change

	('_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/%20').toLowerCase() ===
	('_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/%20').toLowerCase()
	? '_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/%20'
	: ''
	'_%2E~0-9abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/%20'

[danieljbruce]

This change was undone in favor of adding assert statements only.

[danieljbruce]

I think this covers REST calls for Gapic clients, but I'm going to further investigate non-gapic clients since they don't use gax.

[westarle]

please read go/client-libraries:rest-special-uri-chars for guidance on the fix.

[danieljbruce]

please read go/client-libraries:rest-special-uri-chars for guidance on the fix.

Yeah. Seems like something more advanced is necessary here.