Skip to content

fix(tools/http): prevent path traversal and base path scope escape#3218

Merged
duwenxin99 merged 4 commits into
mainfrom
fix/dot-segment
May 12, 2026
Merged

fix(tools/http): prevent path traversal and base path scope escape#3218
duwenxin99 merged 4 commits into
mainfrom
fix/dot-segment

Conversation

@duwenxin99

@duwenxin99 duwenxin99 commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
  • Rejects relative or URL-encoded dot segments (.., %2e%2e) to prevent directory traversal.
  • Enforces verification to ensure resolved paths do not escape the intended base path scope or allow unauthorized access to sibling paths sharing a simple string prefix.
  • Add pathEscape and queryEscape template functions to prevent path tempering.

@duwenxin99 duwenxin99 requested a review from a team as a code owner May 12, 2026 17:49
gemini-code-assist[bot]
gemini-code-assist Bot reviewed May 12, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces path validation and scope enforcement to prevent path traversal vulnerabilities when resolving URLs. It includes a new test suite covering various edge cases such as URL-encoded dot segments and sibling path traversal. The review feedback identifies that the current dot-segment check is overly restrictive because it scans the entire relative path string, which could incorrectly block valid query parameters or filenames; a more precise approach involving segment-based validation is suggested.

Comment thread internal/tools/http/http.go Outdated
@duwenxin99 duwenxin99 enabled auto-merge (squash) May 12, 2026 21:27
@duwenxin99 duwenxin99 merged commit 80a6602 into main May 12, 2026
26 checks passed
@duwenxin99 duwenxin99 deleted the fix/dot-segment branch May 12, 2026 21:31
@github-actions

github-actions Bot commented May 12, 2026

Copy link
Copy Markdown
Contributor

🧨 Preview deployments removed.

Cloudflare Pages environments for pr-3218 have been deleted.

github-actions Bot pushed a commit that referenced this pull request May 12, 2026
@duwenxin99
deploy: fix(tools/http): prevent path traversal and base path scope e…
c886b81 
…scape (#3218)

- Rejects relative or URL-encoded dot segments (`..`, `%2e%2e`) to
prevent directory traversal.
- Enforces verification to ensure resolved paths do not escape the
intended base path scope or allow unauthorized access to sibling paths
sharing a simple string prefix.
- Add `pathEscape` and `queryEscape` template functions to prevent path
tempering. 80a6602
github-actions Bot pushed a commit to renovate-bot/googleapis-_-genai-toolbox that referenced this pull request May 12, 2026
@renovate-bot
deploy: fix(tools/http): prevent path traversal and base path scope e…
ada5ca6 
…scape (googleapis#3218)

- Rejects relative or URL-encoded dot segments (`..`, `%2e%2e`) to
prevent directory traversal.
- Enforces verification to ensure resolved paths do not escape the
intended base path scope or allow unauthorized access to sibling paths
sharing a simple string prefix.
- Add `pathEscape` and `queryEscape` template functions to prevent path
tempering. 80a6602
github-actions Bot pushed a commit to pepe57/genai-toolbox that referenced this pull request May 12, 2026
@pull
deploy: fix(tools/http): prevent path traversal and base path scope e…
599df89 
…scape (googleapis#3218)

- Rejects relative or URL-encoded dot segments (`..`, `%2e%2e`) to
prevent directory traversal.
- Enforces verification to ensure resolved paths do not escape the
intended base path scope or allow unauthorized access to sibling paths
sharing a simple string prefix.
- Add `pathEscape` and `queryEscape` template functions to prevent path
tempering. 80a6602
github-actions Bot pushed a commit to Jaleel-zhu/genai-toolbox that referenced this pull request May 12, 2026
@pull
deploy: fix(tools/http): prevent path traversal and base path scope e…
d182d01 
…scape (googleapis#3218)

- Rejects relative or URL-encoded dot segments (`..`, `%2e%2e`) to
prevent directory traversal.
- Enforces verification to ensure resolved paths do not escape the
intended base path scope or allow unauthorized access to sibling paths
sharing a simple string prefix.
- Add `pathEscape` and `queryEscape` template functions to prevent path
tempering. 80a6602
@release-please release-please Bot mentioned this pull request May 14, 2026
Merged
pavankrishna13 pushed a commit to pavankrishna13/genai-toolbox that referenced this pull request May 19, 2026
@duwenxin99 @pavankrishna13
fix(tools/http): prevent path traversal and base path scope escape (g…
652678b 
…oogleapis#3218)

- Rejects relative or URL-encoded dot segments (`..`, `%2e%2e`) to
prevent directory traversal.
- Enforces verification to ensure resolved paths do not escape the
intended base path scope or allow unauthorized access to sibling paths
sharing a simple string prefix.
- Add `pathEscape` and `queryEscape` template functions to prevent path
tempering.
Yuan325 added a commit that referenced this pull request May 21, 2026
@release-please @Yuan325
chore(main): release 1.3.0 (#3228)
b001006 
🤖 I have created a release *beep* *boop*
---


##
[1.3.0](v1.2.0...v1.3.0)
(2026-05-21)


### Features

* **auth:** Implement MCP auth tool-level scopes validation
([#3049](#3049))
([c528985](c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([#3253](#3253))
([75da6c2](75da6c2))
* Setup SQLCommenter and allow client metadata
([#3064](#3064))
([9f1f9b3](9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([#3083](#3083))
([ef300a8](ef300a8))


### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([#3251](#3251))
([f4d16c0](f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([#3036](#3036))
([c739b80](c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([#3218](#3218))
([80a6602](80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([#3233](#3233))
([4f409a3](4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([#3273](#3273))
([1e3de96](1e3de96))
* **tools:** Initialize query result slices to empty array
([#3250](#3250))
([60ddf48](60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
github-actions Bot pushed a commit that referenced this pull request May 21, 2026
@Yuan325 @release-please
deploy: chore(main): release 1.3.0 (#3228)
1d64c0d 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([#3049](#3049))
([c528985](c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([#3253](#3253))
([75da6c2](75da6c2))
* Setup SQLCommenter and allow client metadata
([#3064](#3064))
([9f1f9b3](9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([#3083](#3083))
([ef300a8](ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([#3251](#3251))
([f4d16c0](f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([#3036](#3036))
([c739b80](c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([#3218](#3218))
([80a6602](80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([#3233](#3233))
([4f409a3](4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([#3273](#3273))
([1e3de96](1e3de96))
* **tools:** Initialize query result slices to empty array
([#3250](#3250))
([60ddf48](60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to renovate-bot/googleapis-_-genai-toolbox that referenced this pull request May 21, 2026
@renovate-bot @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
2d4c637 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to rodineyw/mcp-toolbox that referenced this pull request May 21, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
37848f1 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to Jaleel-zhu/genai-toolbox that referenced this pull request May 21, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
6c4e70d 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
@BrewTestBot BrewTestBot mentioned this pull request May 21, 2026
Merged
github-actions Bot pushed a commit to pepe57/genai-toolbox that referenced this pull request May 22, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
402bf8c 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to CrazyForks/genai-toolbox that referenced this pull request May 22, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
ebc4be2 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to bhardwajRahul/genai-toolbox that referenced this pull request May 23, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
e3bd116 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kurtisvg kurtisvg kurtisvg approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@Yuan325 Yuan325

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@duwenxin99 @kurtisvg @Yuan325