rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Escape dynamic path segments in the Google Analytics and Segment drivers

Browse Source 
The GA4 driver passed the account and property IDs to url.JoinPath as raw
segments, and the Segment driver built its per-user endpoint by
concatenating the user ID into url.URL.Path — both bypass the url.PathEscape
rule that every sibling driver (and the matching name resolvers) already
follow. The IDs are numeric today so there is no behaviour change, but this
keeps the drivers consistent and safe if a provider ever returns a segment
with a reserved character.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-12 11:24:01 +02:00
parent 2298b74757
commit 0b81393bdf
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/accessreview/drivers/google_analytics.go
View File

@@ -94,7 +94,7 @@ func (d *GoogleAnalyticsDriver) ListAccounts(ctx context.Context) ([]AccountReco
members := make(map[string]*googleAnalyticsMember)
// Account-level bindings.
if err := d.collectBindings(ctx, members, "v1alpha", "accounts", d.accountID, "accessBindings"); err != nil {
if err := d.collectBindings(ctx, members, "v1alpha", "accounts", url.PathEscape(d.accountID), "accessBindings"); err != nil {
return nil, err
}
@@ -105,7 +105,7 @@ func (d *GoogleAnalyticsDriver) ListAccounts(ctx context.Context) ([]AccountReco
}
for _, propertyID := range propertyIDs {
if err := d.collectBindings(ctx, members, "v1alpha", "properties", propertyID, "accessBindings"); err != nil {
if err := d.collectBindings(ctx, members, "v1alpha", "properties", url.PathEscape(propertyID), "accessBindings"); err != nil {
return nil, err
}
}

9
pkg/accessreview/drivers/segment.go
View File

@@ -204,12 +204,13 @@ func (d *SegmentDriver) listUsers(ctx context.Context, base *url.URL) ([]segment
}
func (d *SegmentDriver) userPermissions(ctx context.Context, base *url.URL, userID string) ([]segmentPermission, error) {
endpoint := *base
// Path holds the decoded value; endpoint.String() escapes the id once.
endpoint.Path = "/users/" + userID
endpoint, err := url.JoinPath(base.String(), "users", url.PathEscape(userID))
if err != nil {
return nil, fmt.Errorf("cannot build segment user URL: %w", err)
}
var resp segmentUserResponse
if err := d.getJSON(ctx, endpoint.String(), &resp); err != nil {
if err := d.getJSON(ctx, endpoint, &resp); err != nil {
return nil, err
}