fix rest templates

Author: daniel-sanche

packages/google-api-core/google/api_core/path_template.py

@@ -29,6 +29,7 @@
 import copy
 import functools
 import re
+import urllib.parse
 
 # Regular expression for extracting variable parts from a path template.
 # The variables can be expressed as:
@@ -83,15 +84,19 @@ def _expand_variable_match(positional_vars, named_vars, match):
     name = match.group("name")
     if name is not None:
         try:
-            return str(named_vars[name])
+            val = str(named_vars[name])
+            # Percent-encode while keeping '/' safe to preserve existing route and slash validation
+            return urllib.parse.quote(val, safe="/")
         except KeyError:
             raise ValueError(
                 "Named variable '{}' not specified and needed by template "
                 "`{}` at position {}".format(name, match.string, match.start())
             )
     elif positional is not None:
         try:
-            return str(positional_vars.pop(0))
+            val = str(positional_vars.pop(0))
+            # Percent-encode while keeping '/' safe to preserve existing route and slash validation
+            return urllib.parse.quote(val, safe="/")
         except IndexError:
             raise ValueError(
                 "Positional variable not specified and needed by template "

packages/google-api-core/tests/unit/test_path_template.py

@@ -63,6 +63,17 @@
             {"name": "parent/child/object"},
             "/v1/a/parent/child/object",
         ],
+        # Encoding / Metacharacters in positional and named params
+        ["/v1/*", ["..?$httpMethod=DELETE#"], {}, "/v1/..%3F%24httpMethod%3DDELETE%23"],
+        ["/v1/**", ["path/../with/?and#"], {}, "/v1/path/../with/%3Fand%23"],
+        ["/v1/{name}", [], {"name": "..?$httpMethod=DELETE#"}, "/v1/..%3F%24httpMethod%3DDELETE%23"],
+        ["/v1/{name=**}", [], {"name": "path/../with/?and#"}, "/v1/path/../with/%3Fand%23"],
+        [
+            "/v3/{session=projects/*/locations/*/agents/*/sessions/*}:detectIntent",
+            [],
+            {"session": "projects/cx/locations/global/agents/a1/sessions/..?$httpMethod=DELETE#"},
+            "/v3/projects/cx/locations/global/agents/a1/sessions/..%3F%24httpMethod%3DDELETE%23:detectIntent",
+        ],
     ],
 )
 def test_expand_success(tmpl, args, kwargs, expected_result):