rely more on _validate_multi_segment_value

Author: daniel-sanche

packages/google-api-core/google/api_core/path_template.py

@@ -94,6 +94,9 @@ def _validate_multi_segment_value(val: str) -> bool:
         bool: True if the value is valid and does not violate traversal boundaries,
             False otherwise.
     """
+    if val in ('', '.', '..'):
+        return False
+
     segments = val.split("/")
     leftover_segments = 0
     unseen_segments = len(segments)
@@ -210,40 +213,33 @@ def _extract_and_validate_wildcards(
         f"Invalid value {val} for {property_name or 'positional variable'}."
     )
 
-    # Single-segment templates (None or "*") cannot match exactly "." or ".."
-    # and cannot have multi-segment paths resolving to 0 segments.
     if template_str is None or template_str == "*":
-        if val in (".", "..") or (val and not _validate_multi_segment_value(val)):
+        # Single-segment templates (None or "*") cannot match exactly "." or ".."
+        # and cannot have multi-segment paths resolving to 0 segments.
+        if val and not _validate_multi_segment_value(val):
             raise err
-        return
-
-    # Multi-segment templates ("**") must represent at least one valid, non-escaped segment.
-    if template_str == "**":
+    elif template_str == "**":
+        # Multi-segment templates ("**") must represent at least one valid,
+        # non-escaped segment.
         if not _validate_multi_segment_value(val):
             raise err
-        return
-
-    # Compile the sub-template into a regex capture pattern
-    # to isolate and validate individual wildcard values.
-    pattern, wildcard_types = _build_capture_pattern(template_str)
-
-    m = pattern.fullmatch(val)
-    if m is not None:
-        # Validate each wildcard value within its matched boundaries,
-        # preventing traversals from escaping their structural positions.
-        for i, wildcard_type in enumerate(wildcard_types):
-            captured_val = m.group(i + 1)
-            if wildcard_type == "*":
-                if captured_val in (".", ".."):
-                    raise err
-            else:
+    else:
+        # Compile the sub-template into a regex capture pattern
+        # to isolate and validate individual wildcard values.
+        pattern, wildcard_types = _build_capture_pattern(template_str)
+
+        m = pattern.fullmatch(val)
+        if m is not None:
+            # Validate each wildcard value within its matched boundaries,
+            # preventing traversals from escaping their structural positions.
+            for captured_val in m.groups():
                 if not _validate_multi_segment_value(captured_val):
                     raise err
-    else:
-        # For values that don't match the pattern, ensure the value doesn't
-        # resolve to 0 segments (e.g. "projects/..").
-        if val and not _validate_multi_segment_value(val):
-            raise err
+        else:
+            # For values that don't match the pattern, ensure the value doesn't
+            # resolve to 0 segments (e.g. "projects/..").
+            if val and not _validate_multi_segment_value(val):
+                raise err
 
 
 def _expand_variable_match(positional_vars, named_vars, match):

packages/google-api-core/tests/unit/test_path_template.py

@@ -843,6 +843,7 @@ def test_build_capture_pattern(template_str, expected_pattern, expected_wildcard
         ("a/b/c/d/e/../../../..", True),
         ("a/b/../..", False),
         ("a/b/../../..", False),
+        ('', False),
         (".", False),
         ("..", False),
         ("", False),
@@ -857,3 +858,32 @@ def test_build_capture_pattern(template_str, expected_pattern, expected_wildcard
 def test_validate_multi_segment_value(val, expected_valid):
     result = path_template._validate_multi_segment_value(val)
     assert result == expected_valid
+
+
+@pytest.mark.parametrize(
+    "val, template_str, expect_error",
+    [
+        ("api", None, False),
+        ("api", "*", False),
+        (".", None, True),
+        ("..", None, True),
+        (".", "*", True),
+        ("..", "*", True),
+        ("", "*", False),
+        ("api/v1", "**", False),
+        (".", "**", True),
+        ("..", "**", True),
+        ("", "**", True),
+        ("projects/my-proj/locations/us-central1", "projects/*/locations/*", False),
+        ("projects/my-proj/locations/.", "projects/*/locations/*", True),
+        ("projects/my-proj/locations/..", "projects/*/locations/*", True),
+        ("projects/../locations/us-central1", "projects/*/locations/*", True),
+    ],
+)
+def test_extract_and_validate_wildcards(val, template_str, expect_error):
+    if expect_error:
+        with pytest.raises(ValueError):
+            path_template._extract_and_validate_wildcards(val, template_str)
+    else:
+        # Should not raise any exception
+        path_template._extract_and_validate_wildcards(val, template_str)