The methods that reach a static- or dynamic-policy route by id insert the id into the path as given, without percent-encoding it (urllib.parse.quote(policy_id, safe="")). An id that contains /, ? or # therefore reaches a different route, or turns the rest of the id into a query or a fragment, instead of being refused or sent as one path segment.
The affected methods, on the asynchronous and the synchronous client alike: get_static_policy, update_static_policy, delete_static_policy, toggle_static_policy, get_static_policy_versions, create_policy_override, delete_policy_override, get_dynamic_policy, update_dynamic_policy, delete_dynamic_policy and toggle_dynamic_policy.
This is pre-existing, not a regression. The ids these routes take are UUIDs and slugs today, so no known caller is affected. It was found in review of the v11 parity change (#262), which builds each of these paths from its route template and deliberately leaves escaping out, so that change does not alter what goes on the wire. The Go SDK has the same gap: getaxonflow/axonflow-sdk-go#238.
Fix: escape the id where the template's {id} is filled, with a test that sends an id containing / and ? and asserts the path the server receives.
The methods that reach a static- or dynamic-policy route by id insert the id into the path as given, without percent-encoding it (
urllib.parse.quote(policy_id, safe="")). An id that contains/,?or#therefore reaches a different route, or turns the rest of the id into a query or a fragment, instead of being refused or sent as one path segment.The affected methods, on the asynchronous and the synchronous client alike:
get_static_policy,update_static_policy,delete_static_policy,toggle_static_policy,get_static_policy_versions,create_policy_override,delete_policy_override,get_dynamic_policy,update_dynamic_policy,delete_dynamic_policyandtoggle_dynamic_policy.This is pre-existing, not a regression. The ids these routes take are UUIDs and slugs today, so no known caller is affected. It was found in review of the v11 parity change (#262), which builds each of these paths from its route template and deliberately leaves escaping out, so that change does not alter what goes on the wire. The Go SDK has the same gap: getaxonflow/axonflow-sdk-go#238.
Fix: escape the id where the template's
{id}is filled, with a test that sends an id containing/and?and asserts the path the server receives.