added extra check for valdidity

Author: daniel-sanche

packages/google-api-core/google/api_core/path_template.py

@@ -206,33 +206,44 @@ def _extract_and_validate_wildcards(
     Raises:
         ValueError: If a wildcard within a structurally valid value violates path traversal rules.
     """
+    err = ValueError(
+        f"Invalid value {val} for {property_name or 'positional variable'}."
+    )
+
+    # Single-segment templates (None or "*") cannot match exactly "." or ".."
+    # and cannot have multi-segment paths resolving to 0 segments.
     if template_str is None or template_str == "*":
-        if val in (".", ".."):
-            name_str = property_name if property_name else "positional variable"
-            raise ValueError("Invalid value {} for {}.".format(val, name_str))
+        if val in (".", "..") or (val and not _validate_multi_segment_value(val)):
+            raise err
         return
 
+    # Multi-segment templates ("**") must represent at least one valid, non-escaped segment.
     if template_str == "**":
         if not _validate_multi_segment_value(val):
-            name_str = property_name if property_name else "positional variable"
-            raise ValueError("Invalid value {} for {}.".format(val, name_str))
+            raise err
         return
 
-    # Sub-template case: use cached capture pattern and regex match
+    # Compile the sub-template into a regex capture pattern
+    # to isolate and validate individual wildcard values.
     pattern, wildcard_types = _build_capture_pattern(template_str)
 
     m = pattern.fullmatch(val)
     if m is not None:
+        # Validate each wildcard value within its matched boundaries,
+        # preventing traversals from escaping their structural positions.
         for i, wildcard_type in enumerate(wildcard_types):
             captured_val = m.group(i + 1)
             if wildcard_type == "*":
                 if captured_val in (".", ".."):
-                    name_str = property_name if property_name else "positional variable"
-                    raise ValueError("Invalid value {} for {}.".format(val, name_str))
+                    raise err
             else:
                 if not _validate_multi_segment_value(captured_val):
-                    name_str = property_name if property_name else "positional variable"
-                    raise ValueError("Invalid value {} for {}.".format(val, name_str))
+                    raise err
+    else:
+        # For values that don't match the pattern, ensure the value doesn't 
+        # resolve to 0 segments (e.g. "projects/..").
+        if val and not _validate_multi_segment_value(val):
+            raise err
 
 
 def _expand_variable_match(positional_vars, named_vars, match):

packages/google-api-core/tests/unit/test_path_template.py

@@ -717,6 +717,19 @@ def helper_test_transcode(http_options_list, expected_result_list):
             {"parent": "projects/my-project/locations/."},
             "Invalid value projects/my-project/locations/\\. for parent\\.",
         ],
+        # Non-matching values with path traversal (bypass prevention)
+        [
+            "/v2/{parent=projects/*/locations/*}/content:inspect",
+            [],
+            {"parent": "projects/.."},
+            "Invalid value projects/\\.\\. for parent\\.",
+        ],
+        [
+            "/v1/{name}",
+            [],
+            {"name": "projects/.."},
+            "Invalid value projects/\\.\\. for name\\.",
+        ],
     ],
 )
 def test_path_traversal_dots_validation_star(tmpl, args, kwargs, expected_err_match):