fix: reject empty and dot path segments before building request URLs

[gjtorikian]

Description

• _encode_path in src/workos/_base_client.py (hand-maintained, @oagen-ignore-file) now raises ValueError when any path segment is empty, ., or ... Percent-encoding with safe="" already contains /, ?, #, and %, but . is an RFC 3986 unreserved character that urllib.parse.quote never encodes, and httpx applies dot-segment removal when it builds the request URL. A caller-supplied id or slug of .. therefore collapsed the path onto the parent resource before the request left the process (for example, disconnecting a connected account became a DELETE of the whole user).
• The docstring no longer claims that quoting alone keeps .. inside its segment.
• Regression tests added to tests/test_generated_client.py: rejection of ""/./.. for both clients and for build_url, encoding of structural characters (a/b → a%2Fb, %2e%2e → %252e%252e, evil/../.. stays one segment, ... and .hidden are still accepted), and an end-to-end check that pipes.delete_user_connected_account(user_id, "..") raises before any HTTP request on both sync and async clients.

Every generated resource builds its path as a tuple and routes through this helper, so no regeneration is needed. Supersedes #726, which targeted the 4.x branch, where this helper does not exist.

Resolves VULN-1272.

Compatibility

Path identifiers equal to "", ".", or ".." now raise ValueError before any HTTP request. Such values were never valid WorkOS identifiers; previously they were sent as a request to a different resource. No other input handling changes.

Validation

• uv run pytest: 2771 passed (2752 baseline + 19 new).
• uv run ruff format --check ., uv run ruff check, uv run pyright: clean.

Documentation

No API reference changes. The behavior change is documented in the helper docstring and the Compatibility section above for release notes.

[linear-code]

VULN-1272

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the centralized validation closes the path-normalization issue without disrupting legitimate resource paths.

Summary

• Applies validation centrally to generated synchronous and asynchronous resource requests and build_url.
• Preserves percent-encoding for structural characters and valid dot-containing identifiers.
• Adds regression coverage for direct encoding, URL building, and end-to-end request prevention.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Resource method] --> B[Tuple of path segments]
    B --> C{Any segment empty, dot, or dot-dot?}
    C -->|Yes| D[Raise ValueError before HTTP request]
    C -->|No| E[Percent-encode each segment]
    E --> F[Join encoded segments]
    F --> G[Build URL]
    G --> H[Sync or async HTTP transport]

Loading

_{Reviews (1) · Last reviewed commit: "fix: reject empty and dot path segments ..."}