feat(python): add encode_path_params config to percent-encode path parameters

generators/python/core_utilities/shared/jsonable_encoder.py

@@ -13,6 +13,7 @@
 from pathlib import PurePath
 from types import GeneratorType
 from typing import Any, Callable, Dict, List, Optional, Set, Union
+from urllib.parse import quote
 
 import pydantic
 from .datetime_utils import serialize_datetime
@@ -116,3 +117,15 @@ def encode_path_param(obj: Any) -> str:
     if isinstance(obj, bool):
         return "true" if obj else "false"
     return str(jsonable_encoder(obj))
+
+
+def quote_path_param(obj: Any) -> str:
+    """Encode a value for use in a URL path segment, percent-encoding it.
+
+    Same as encode_path_param, except the result is percent-encoded so
+    that a value containing "/" or ".." cannot change which endpoint
+    the request resolves to.
+    """
+    if isinstance(obj, bool):
+        return "true" if obj else "false"
+    return quote(str(jsonable_encoder(obj)), safe="")

generators/python/sdk/changes/unreleased/encode-path-parameters.yml

@@ -0,0 +1,7 @@
+- summary: |
+    Add an `encode_path_params` config option (default `false`). When enabled, path parameter
+    values are percent-encoded when substituted into the request path, so a value containing `/`
+    or `..` can no longer change which endpoint the request resolves to. The default `false`
+    preserves the existing (unencoded) behavior; TypeScript, Go, Java, and C# already encode path
+    params.
+  type: feat

generators/python/src/fern_python/generators/sdk/core_utilities/core_utilities.py

@@ -44,6 +44,7 @@ def __init__(
         self._version = custom_config.pydantic_config.version
         self._project_module_path = project_module_path
         self._use_pydantic_field_aliases = custom_config.pydantic_config.use_pydantic_field_aliases
+        self._encode_path_params = custom_config.encode_path_params
         self._should_generate_websocket_clients = custom_config.should_generate_websocket_clients
         self._exclude_types_from_init_exports = custom_config.exclude_types_from_init_exports
         self._custom_pager_base_name = self._sanitize_pager_name(custom_config.custom_pager_name or "CustomPager")
@@ -682,7 +683,7 @@ def encode_path_param(self, obj: AST.Expression) -> AST.Expression:
                     qualified_name_excluding_import=(),
                     import_=AST.ReferenceImport(
                         module=AST.Module.local(*self._module_path, "jsonable_encoder"),
-                        named_import="encode_path_param",
+                        named_import="quote_path_param" if self._encode_path_params else "encode_path_param",
                     ),
                 ),
                 args=[obj],

generators/python/src/fern_python/generators/sdk/custom_config.py

@@ -129,6 +129,11 @@ class SDKCustomConfig(pydantic.BaseModel):
     # If true, treats path parameters as named parameters in endpoint functions
     inline_path_params: bool = False
 
+    # If true, path parameter values are percent-encoded when substituted into the
+    # request path, so a value containing "/" or ".." cannot change which endpoint
+    # the request resolves to. Off by default so existing output is unchanged.
+    encode_path_params: bool = False
+
     # Feature flag that enables generation of Python websocket clients
     should_generate_websocket_clients: bool = False
 

generators/python/tests/sdk/test_jsonable_encoder.py

@@ -2,10 +2,31 @@
 
 from fern.generator_exec.logging import GeneratorUpdate, InitUpdateV2
 
-from core_utilities.shared.jsonable_encoder import jsonable_encoder
+from core_utilities.shared.jsonable_encoder import encode_path_param, jsonable_encoder, quote_path_param
 
 
 def test_jsonable_encoder() -> None:
     updates: List[GeneratorUpdate] = [GeneratorUpdate.factory.init_v_2(InitUpdateV2(publishing_to_registry=None))]
     serialized = jsonable_encoder(updates)
     assert serialized == [{"_type": "initV2", "publishingToRegistry": None}]
+
+
+def test_encode_path_param() -> None:
+    assert encode_path_param("../connections") == "../connections"
+    assert encode_path_param("user_1") == "user_1"
+    assert encode_path_param(42) == "42"
+    assert encode_path_param(True) == "true"
+    assert encode_path_param(False) == "false"
+
+
+def test_quote_path_param() -> None:
+    assert quote_path_param("../connections") == "..%2Fconnections"
+    assert quote_path_param("user id?") == "user%20id%3F"
+    assert quote_path_param("user_1") == "user_1"
+    assert quote_path_param(42) == "42"
+    assert quote_path_param(True) == "true"
+    assert quote_path_param(False) == "false"
+    # every "/" is encoded, so a multi-segment value cannot change the endpoint
+    assert quote_path_param("a/b/c") == "a%2Fb%2Fc"
+    # already-encoded input is encoded again rather than passed through
+    assert quote_path_param("a%2Fb") == "a%252Fb"