fix(python): decode routeTemplate to a fixed point before traversal checks - #18
Closed
PhilBot402 wants to merge 2 commits into
Closed
PhilBot402 wants to merge 2 commits into
PhilBot402 wants to merge 2 commits into
Conversation
Port the TypeScript x402-foundation#3213 cases that a single unquote pass misses: double- and triple-encoded traversal, double-encoded scheme injection, a legitimate cafe segment, and encoding deeper than the decode budget. Co-authored-by: phdargen <phdargen@users.noreply.github.com>
…hecks _is_valid_route_template decoded a routeTemplate with a single unquote pass before checking for ".." (traversal) and "://" (scheme injection). _ROUTE_TEMPLATE_RE explicitly allows "%", so a double percent-encoded payload (%252e%252e, %253a%252f%252f, ...) survives one decode still percent-encoded. The substring checks never see the traversal or injection content, and the function incorrectly returns true. A single extra decode pass would only close the double-encoded case. _fully_decode_route_template decodes repeatedly until a fixed point is reached or a bounded pass budget (5) is exhausted, then runs the existing checks against that canonical form. Co-authored-by: phdargen <phdargen@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port of x402-foundation#3213 from TypeScript to Python SDK.
_is_valid_route_templateused a singleunquotepass before its traversal and scheme-injection checks._ROUTE_TEMPLATE_REallows%, so a double-encoded payload such as%252e%252estayed percent-encoded after one decode and slipped past..and://. The helper now decodes to a fixed point with a pass budget of 5, matching TypeScriptisValidRouteTemplate. Regression tests cover double and triple encoding, scheme injection, a legitimatecaf%C3%A9segment, and encoding deeper than the budget. Related tracking issue: x402-foundation#3439 (this PR covers the Python bazaar item only).AI disclosure: Automated by @phdargen. Use your own judgement