6363_MULTI_SEGMENT_PATTERN = r"(.+)"
6464
6565
66- def _validate_multi_segment_value (val ) :
67- """Validate a multi-segment wildcard value for path traversal vulnerabilities .
66+ def _validate_multi_segment_value (val : str ) -> bool :
67+ """Validate a multi-segment wildcard value.
6868
6969 This function implements the dot and double-dot traversal validation rule
7070 for values matching '**'. It splits the value by '/' into segments and
@@ -79,6 +79,14 @@ def _validate_multi_segment_value(val):
7979 - No segments remain after executing all path traversal commands (leftover
8080 segment count is 0), meaning the entire value is consumed.
8181
82+ Examples:
83+ >>> _validate_multi_segment_value("instance/my-instance")
84+ True
85+ >>> _validate_multi_segment_value("instance/my-instance/..")
86+ True
87+ >>> _validate_multi_segment_value("instance/../..")
88+ False
89+
8290 Args:
8391 val (str): The value matched to the '**' wildcard to validate.
8492
@@ -106,7 +114,7 @@ def _validate_multi_segment_value(val):
106114
107115
108116@functools .lru_cache (maxsize = 1024 )
109- def _build_capture_pattern (template_str ) :
117+ def _build_capture_pattern (template_str : str ) -> tuple [ str , tuple [ str , ...]] :
110118 """Build a regex pattern to capture wildcard matches from a template.
111119
112120 This function parses a template string containing positional/named
@@ -164,7 +172,9 @@ def replacer(match):
164172 return pattern , tuple (wildcard_types )
165173
166174
167- def _validate_value_against_template (val , template_str , property_name = None ):
175+ def _validate_value_against_template (
176+ val : str , template_str : str | None , property_name : str | None = None
177+ ) -> None :
168178 """Validate a variable's value against its template structure.
169179
170180 This function extracts substrings matching individual wildcards in the
@@ -175,6 +185,16 @@ def _validate_value_against_template(val, template_str, property_name=None):
175185 to ensure path traversal commands do not consume the entire value or
176186 escape the starting boundaries of the matched parameter.
177187
188+ Examples:
189+ >>> _validate_value_against_template("us-central1", None, "region")
190+ None
191+ >>> _validate_value_against_template("..", None, "region")
192+ ValueError("Invalid value .. for region.")
193+ >>> _validate_value_against_template(
194+ ... "projects/my-proj/locations/.", "projects/*/locations/*", "parent"
195+ ... )
196+ ValueError("Invalid value projects/my-proj/locations/. for parent.")
197+
178198 Args:
179199 val (str): The raw string value to validate.
180200 template_str (str): The template string of the variable (e.g. 'projects/*/locations/*').
0 commit comments