feat(python): add encode_path_params config to percent-encode path parameters

generators/python/core_utilities/shared/jsonable_encoder.py

@@ -13,6 +13,7 @@
 from pathlib import PurePath
 from types import GeneratorType
 from typing import Any, Callable, Dict, List, Optional, Set, Union
+from urllib.parse import quote
 
 import pydantic
 from .datetime_utils import serialize_datetime
@@ -111,8 +112,10 @@ def encode_path_param(obj: Any) -> str:
 
     Ensures proper string conversion for all types, including
     booleans which need lowercase 'true'/'false' rather than
-    Python's 'True'/'False'.
+    Python's 'True'/'False'. The result is percent-encoded so that a
+    value containing "/" or ".." cannot change which endpoint the
+    request resolves to.
     """
     if isinstance(obj, bool):
         return "true" if obj else "false"
-    return str(jsonable_encoder(obj))
+    return quote(str(jsonable_encoder(obj)), safe="")

generators/python/sdk/changes/unreleased/encode-path-parameters.yml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=../../../../../fern-changes-yml.schema.json
+
+- summary: |
+    Percent-encode path parameter values. `encode_path_param` previously only stringified the value,
+    so a value containing `/` or `..` could change which endpoint the request resolved to. It now
+    applies `urllib.parse.quote(..., safe="")`, matching the TypeScript, Go, Java, and C# generators.
+  type: fix

generators/python/tests/sdk/test_jsonable_encoder.py

@@ -2,10 +2,19 @@
 
 from fern.generator_exec.logging import GeneratorUpdate, InitUpdateV2
 
-from core_utilities.shared.jsonable_encoder import jsonable_encoder
+from core_utilities.shared.jsonable_encoder import encode_path_param, jsonable_encoder
 
 
 def test_jsonable_encoder() -> None:
     updates: List[GeneratorUpdate] = [GeneratorUpdate.factory.init_v_2(InitUpdateV2(publishing_to_registry=None))]
     serialized = jsonable_encoder(updates)
     assert serialized == [{"_type": "initV2", "publishingToRegistry": None}]
+
+
+def test_encode_path_param() -> None:
+    assert encode_path_param("../connections") == "..%2Fconnections"
+    assert encode_path_param("user id?") == "user%20id%3F"
+    assert encode_path_param("user_1") == "user_1"
+    assert encode_path_param(42) == "42"
+    assert encode_path_param(True) == "true"
+    assert encode_path_param(False) == "false"