fix: prevent cross-user session data disclosure in VertexAiSessionService

- listSessions now sends the user id as a quoted, escaped AIP-160 filter
  literal so its contents cannot alter the query.
- getSession and deleteSession verify the session belongs to the requesting
  user.
- Session ids are validated before being used in request paths.

PiperOrigin-RevId: 942103179

Author: Mateusz Krawiec

core/src/main/java/com/google/adk/sessions/VertexAiClient.java

@@ -105,13 +105,27 @@ private Completable pollOperation(String operationId, int attempt) {
   }
 
   Maybe<JsonNode> listSessions(String reasoningEngineId, String userId) {
+    // Send the user id as a quoted AIP-160 literal so its contents cannot alter
+    // the filter, then URL-escape the whole filter for transport.
+    String filter = "user_id=" + quoteFilterLiteral(userId);
     return performApiRequest(
             "GET",
-            "reasoningEngines/" + reasoningEngineId + "/sessions?filter=user_id=" + userId,
+            "reasoningEngines/"
+                + reasoningEngineId
+                + "/sessions?filter="
+                + UrlEscapers.urlFormParameterEscaper().escape(filter),
             "")
         .flatMapMaybe(VertexAiClient::getJsonResponse);
   }
 
+  /**
+   * Wraps a value in an AIP-160 double-quoted string literal. Per go/aip/160, only backslashes and
+   * double quotes need escaping inside the quotes.
+   */
+  private static String quoteFilterLiteral(String value) {
+    return "\"" + value.replace("\\", "\\\\").replace("\"", "\\\"") + "\"";
+  }
+
   Maybe<JsonNode> listEvents(String reasoningEngineId, String sessionId, @Nullable String filter) {
     String path = "reasoningEngines/" + reasoningEngineId + "/sessions/" + sessionId + "/events";
     if (filter != null) {

core/src/main/java/com/google/adk/sessions/VertexAiSessionService.java

@@ -164,6 +164,7 @@ private ListSessionsResponse parseListSessionsResponse(
 
   @Override
   public Single<ListEventsResponse> listEvents(String appName, String userId, String sessionId) {
+    validateSessionId(sessionId);
     return listEventsInternal(appName, sessionId, /* filter= */ null);
   }
 
@@ -195,11 +196,21 @@ private ListEventsResponse parseListEventsResponse(JsonNode listEventsResponse)
   @Override
   public Maybe<Session> getSession(
       String appName, String userId, String sessionId, Optional<GetSessionConfig> config) {
+    validateSessionId(sessionId);
     String reasoningEngineId = parseReasoningEngineId(appName);
     return client
         .getSession(reasoningEngineId, sessionId)
         .flatMap(
             getSessionResponseMap -> {
+              // Enforce ownership using the owner reported by the backend, not the
+              // requested user id. Deny as not-found so existence is not revealed.
+              String ownerUserId =
+                  Optional.ofNullable(getSessionResponseMap.get("userId"))
+                      .map(JsonNode::asText)
+                      .orElse(null);
+              if (!userId.equals(ownerUserId)) {
+                return Maybe.<Session>empty();
+              }
               String sessId =
                   Optional.ofNullable(getSessionResponseMap.get("name"))
                       .map(name -> Iterables.getLast(Splitter.on('/').splitToList(name.asText())))
@@ -274,12 +285,31 @@ private static List<Event> filterEvents(
 
   @Override
   public Completable deleteSession(String appName, String userId, String sessionId) {
+    validateSessionId(sessionId);
     String reasoningEngineId = parseReasoningEngineId(appName);
-    return client.deleteSession(reasoningEngineId, sessionId);
+    // Fetch first and enforce ownership: the backend delete ignores user id, so
+    // without this check any user could delete another user's session. A missing
+    // session completes as a no-op.
+    return client
+        .getSession(reasoningEngineId, sessionId)
+        .flatMapCompletable(
+            getSessionResponseMap -> {
+              String ownerUserId =
+                  Optional.ofNullable(getSessionResponseMap.get("userId"))
+                      .map(JsonNode::asText)
+                      .orElse(null);
+              if (!userId.equals(ownerUserId)) {
+                return Completable.error(
+                    new SecurityException(
+                        "Session " + sessionId + " does not belong to user " + userId + "."));
+              }
+              return client.deleteSession(reasoningEngineId, sessionId);
+            });
   }
 
   @Override
   public Single<Event> appendEvent(Session session, Event event) {
+    validateSessionId(session.id());
     String reasoningEngineId = parseReasoningEngineId(session.appName());
     return BaseSessionService.super
         .appendEvent(session, event)
@@ -319,4 +349,22 @@ static String parseReasoningEngineId(String appName) {
   private static final Pattern APP_NAME_PATTERN =
       Pattern.compile(
           "^projects/([a-zA-Z0-9-_]+)/locations/([a-zA-Z0-9-_]+)/reasoningEngines/(\\d+)$");
+
+  /** Rejects session ids that could escape the URL path segment. */
+  static void validateSessionId(String sessionId) {
+    if (sessionId == null || !SESSION_ID_PATTERN.matcher(sessionId).matches()) {
+      throw new IllegalArgumentException(
+          "Invalid session id: "
+              + sessionId
+              + ". It must match "
+              + SESSION_ID_PATTERN.pattern()
+              + ".");
+    }
+  }
+
+  /**
+   * Allowed session id characters. Matches the adk-python {@code _validate_session_id} allowlist
+   * and keeps the id within a single URL path segment (no '/', '?', '#', or '..').
+   */
+  private static final Pattern SESSION_ID_PATTERN = Pattern.compile("^[a-zA-Z0-9_-]+$");
 }

core/src/test/java/com/google/adk/sessions/MockApiAnswer.java

@@ -4,6 +4,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.adk.JsonBaseModel;
 import com.google.adk.events.Event;
+import java.io.IOException;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
 import java.time.Instant;
@@ -29,7 +30,8 @@ class MockApiAnswer implements Answer<ApiResponse> {
   private static final Pattern SESSIONS_REGEX =
       Pattern.compile("^reasoningEngines/([^/]+)/sessions$");
   private static final Pattern SESSIONS_FILTER_REGEX =
-      Pattern.compile("^reasoningEngines/([^/]+)/sessions\\?filter=user_id=([^/]+)$");
+      Pattern.compile("^reasoningEngines/([^/]+)/sessions\\?filter=(.+)$");
+  private static final String USER_ID_FILTER_PREFIX = "user_id=";
   private static final Pattern APPEND_EVENT_REGEX =
       Pattern.compile("^reasoningEngines/([^/]+)/sessions/([^/]+):appendEvent$");
   private static final Pattern EVENTS_REGEX =
@@ -135,7 +137,20 @@ private ApiResponse handleGetSessions(String path) throws Exception {
     if (!sessionsMatcher.matches()) {
       return null;
     }
-    String userId = sessionsMatcher.group(2);
+    // Decode the URL-escaped filter and read the quoted user_id literal back with
+    // a JSON parser, as the real server would. An unquoted/injected filter is
+    // rejected.
+    String decodedFilter = URLDecoder.decode(sessionsMatcher.group(2), StandardCharsets.UTF_8);
+    if (!decodedFilter.startsWith(USER_ID_FILTER_PREFIX)) {
+      throw new IllegalArgumentException("Unsupported sessions filter: " + decodedFilter);
+    }
+    String userId;
+    try {
+      userId =
+          mapper.readValue(decodedFilter.substring(USER_ID_FILTER_PREFIX.length()), String.class);
+    } catch (IOException e) {
+      throw new IllegalArgumentException("Unsupported sessions filter: " + decodedFilter, e);
+    }
     List<String> userSessionsJson = new ArrayList<>();
     for (String sessionJson : sessionMap.values()) {
       Map<String, Object> session =

core/src/test/java/com/google/adk/sessions/VertexAiSessionServiceTest.java

@@ -19,6 +19,7 @@
 import com.google.common.collect.ImmutableSet;
 import com.google.genai.types.Content;
 import com.google.genai.types.Part;
+import io.reactivex.rxjava3.core.Completable;
 import io.reactivex.rxjava3.core.Single;
 import java.time.Instant;
 import java.util.Arrays;
@@ -324,7 +325,8 @@ public void listSessions_empty() {
 
   @Test
   public void listSessions_missingSessionsField_returnsEmpty() {
-    when(mockApiClient.request("GET", "reasoningEngines/123/sessions?filter=user_id=userX", ""))
+    when(mockApiClient.request(
+            "GET", "reasoningEngines/123/sessions?filter=user_id%3D%22userX%22", ""))
         .thenAnswer(new MockApiAnswer("{}"));
 
     assertThat(vertexAiSessionService.listSessions("123", "userX").blockingGet().sessions())
@@ -333,13 +335,90 @@ public void listSessions_missingSessionsField_returnsEmpty() {
 
   @Test
   public void listSessions_nullSessionsField_returnsEmpty() {
-    when(mockApiClient.request("GET", "reasoningEngines/123/sessions?filter=user_id=userY", ""))
+    when(mockApiClient.request(
+            "GET", "reasoningEngines/123/sessions?filter=user_id%3D%22userY%22", ""))
         .thenAnswer(new MockApiAnswer("{\"sessions\": null}"));
 
     assertThat(vertexAiSessionService.listSessions("123", "userY").blockingGet().sessions())
         .isEmpty();
   }
 
+  @Test
+  public void listSessions_maliciousUserId_isNeutralized() {
+    // AIP-160 filter-injection payload.
+    String payload = "\" OR user_id=~\"user";
+
+    ListSessionsResponse response =
+        vertexAiSessionService.listSessions("123", payload).blockingGet();
+
+    // Treated as a single literal user id that matches nobody: no other user's
+    // sessions leak.
+    assertThat(response.sessions()).isEmpty();
+
+    ArgumentCaptor<String> pathCaptor = ArgumentCaptor.forClass(String.class);
+    verify(mockApiClient, atLeastOnce()).request(eq("GET"), pathCaptor.capture(), eq(""));
+    String listPath =
+        pathCaptor.getAllValues().stream()
+            .filter(p -> p.contains("/sessions?filter="))
+            .findFirst()
+            .orElseThrow(() -> new AssertionError("No list-sessions request was made"));
+    // The value is sent as a quoted, URL-escaped literal (= -> %3D, " -> %22);
+    // no raw quotes reach the query string.
+    assertThat(listPath).contains("filter=user_id%3D%22");
+    assertThat(listPath).doesNotContain("\"");
+  }
+
+  @Test
+  public void getSession_wrongUser_returnsEmpty() {
+    // Session "1" belongs to "user"; a different user must not be able to read it.
+    assertThat(
+            vertexAiSessionService
+                .getSession("123", "attacker", "1", Optional.empty())
+                .blockingGet())
+        .isNull();
+  }
+
+  @Test
+  public void deleteSession_wrongUser_deniedAndSessionKept() {
+    // The ownership error surfaces on subscription, so hoist the Completable out.
+    Completable deletion = vertexAiSessionService.deleteSession("123", "attacker", "1");
+    assertThrows(SecurityException.class, deletion::blockingAwait);
+    // The session is still readable by its real owner, i.e. it was not deleted.
+    assertThat(
+            vertexAiSessionService.getSession("123", "user", "1", Optional.empty()).blockingGet())
+        .isNotNull();
+  }
+
+  // Session id validation is synchronous, so each call below throws before returning a stream.
+  @Test
+  public void getSession_invalidSessionId_throws() {
+    assertThrows(
+        IllegalArgumentException.class,
+        () -> vertexAiSessionService.getSession("123", "user", "1/../2", Optional.empty()));
+  }
+
+  @Test
+  public void deleteSession_invalidSessionId_throws() {
+    assertThrows(
+        IllegalArgumentException.class,
+        () -> vertexAiSessionService.deleteSession("123", "user", "1\" OR 1"));
+  }
+
+  @Test
+  public void listEvents_invalidSessionId_throws() {
+    assertThrows(
+        IllegalArgumentException.class,
+        () -> vertexAiSessionService.listEvents("123", "user", "a?b"));
+  }
+
+  @Test
+  public void appendEvent_invalidSessionId_throws() {
+    Session session = Session.builder("bad/id").appName("123").userId("user").build();
+    Event event = Event.builder().author("user").build();
+    assertThrows(
+        IllegalArgumentException.class, () -> vertexAiSessionService.appendEvent(session, event));
+  }
+
   @Test
   public void listEvents_empty() {
     assertThat(vertexAiSessionService.listEvents("789", "user1", "3").blockingGet().events())
@@ -348,9 +427,11 @@ public void listEvents_empty() {
 
   @Test
   public void listEmptySession_success() {
+    // Session "3" belongs to "user2"; request as the owner so the events list is
+    // exercised (a non-owner is now denied).
     assertThat(
             vertexAiSessionService
-                .getSession("789", "user1", "3", Optional.empty())
+                .getSession("789", "user2", "3", Optional.empty())
                 .blockingGet()
                 .events())
         .isEmpty();