chore: Renaming attributes in spec modules to align with the new names#647
chore: Renaming attributes in spec modules to align with the new names#647ehsavoie wants to merge 1 commit intoa2aproject:mainfrom
Conversation
Summary of ChangesHello @ehsavoie, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a significant refactoring to standardize attribute naming conventions within the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request renames attributes across the codebase to align with changes in the a2a.proto specification, impacting transport layers, OpenTelemetry instrumentation, server-side handlers, and tests. A critical security vulnerability was identified in the REST transport layer, where methods in RestTransport.java construct URLs using user-supplied identifiers without proper URL encoding, potentially leading to path traversal or URL injection. It is recommended to apply URL encoding to these path parameters. Additionally, a minor formatting issue was noted in DefaultRequestHandler.java. The renames are otherwise consistently applied and align with the PR's goal.
| builder.setId(configId).setTaskId(request.id()); | ||
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/%2s", request.id(), configId)); | ||
| builder.setId(configId).setTaskId(request.taskId()); | ||
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/%2s", request.taskId(), configId)); |
There was a problem hiding this comment.
The taskId and id (configId) parameters are used to construct a URL path without proper URL encoding. If these identifiers contain special characters such as /, ?, or #, it could lead to path traversal or malformed requests to the agent. It is recommended to URL-encode these parameters before including them in the URL string.
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/%2s", request.taskId(), configId)); | |
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/%2s", URLEncoder.encode(request.taskId(), StandardCharsets.UTF_8), URLEncoder.encode(configId, StandardCharsets.UTF_8))); |
There was a problem hiding this comment.
This is wrong as those aren't query parameters
| builder.setTaskId(request.id()); | ||
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/", request.id())); | ||
| builder.setTaskId(request.taskId()); | ||
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/", request.taskId())); |
There was a problem hiding this comment.
The taskId parameter is used to construct a URL path without proper URL encoding. This could lead to path traversal if the identifier contains characters like /. It is recommended to URL-encode the taskId before including it in the URL string.
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/", request.taskId())); | |
| url.append(String.format("/tasks/%1s/pushNotificationConfigs/", URLEncoder.encode(request.taskId(), StandardCharsets.UTF_8))); |
There was a problem hiding this comment.
This is wrong as those aren't query parameters
| agentCard, context); | ||
| try { | ||
| String url = Utils.buildBaseUrl(agentInterface, request.tenant()) + String.format("/tasks/%1s/pushNotificationConfigs/%2s", request.id(), request.pushNotificationConfigId()); | ||
| String url = Utils.buildBaseUrl(agentInterface, request.tenant()) + String.format("/tasks/%1s/pushNotificationConfigs/%2s", request.taskId(), request.id()); |
There was a problem hiding this comment.
The taskId and id parameters are used to construct a URL path without proper URL encoding. This can lead to path traversal or malformed requests if these identifiers contain special characters. It is recommended to URL-encode these parameters before including them in the URL string.
| String url = Utils.buildBaseUrl(agentInterface, request.tenant()) + String.format("/tasks/%1s/pushNotificationConfigs/%2s", request.taskId(), request.id()); | |
| String url = Utils.buildBaseUrl(agentInterface, request.tenant()) + String.format("/tasks/%1s/pushNotificationConfigs/%2s", URLEncoder.encode(request.taskId(), StandardCharsets.UTF_8), URLEncoder.encode(request.id(), StandardCharsets.UTF_8)); |
There was a problem hiding this comment.
This is wrong as those aren't query parameters
server-common/src/main/java/io/a2a/server/requesthandlers/DefaultRequestHandler.java
Show resolved
Hide resolved
…s in the a2a.proto - io.a2a.spec.TaskPushNotificationConfig pushNotificationConfig to config - io.a2a.spec.DeleteTaskPushNotificationConfigParams id to taskId and pushNotificationConfigId to id - io.a2a.spec.GetTaskPushNotificationConfigParams id to taskId and pushNotificationConfigId to id - io.a2a.spec.ListTaskPushNotificationConfigParam s taskId to id Fixing issue a2aproject#634 Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>
ehsavoie
changed the title
2 participants
in the a2a.proto
Fixing issue #634
Fixes #634 🦕