fix(session/vertexai): quote userId in AIP-160 list filter#1171
Open
petrmarinec wants to merge 1 commit into
Open
fix(session/vertexai): quote userId in AIP-160 list filter#1171petrmarinec wants to merge 1 commit into
petrmarinec wants to merge 1 commit into
Conversation
listSessions built the Vertex AI Agent Engine list filter by interpolating the
raw UserID into a quoted AIP-160 string literal
(fmt.Sprintf("userId=\"%s\"", req.UserID)). A double quote in UserID breaks out
of the literal and appends attacker-controlled predicates, e.g. UserID
`attacker" OR userId!="` yields the filter `userId="attacker" OR userId!=""`,
which returns sessions for every user of the deployment (cross-user session
enumeration).
Add quoteFilterLiteral, which escapes backslashes then double quotes so the
value stays inside the literal, and use it when building the filter. Adds a
regression test covering quote injection, backslash-only, and empty input.
This is the Go counterpart of the same issue previously fixed in adk-python
(google/adk-python#5270, PR google/adk-python#5273, commit bdece00).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Link to Issue or Description of Change
Problem
listSessionsinsession/vertexai/vertexai_client.gobuilds the Vertex AI Agent Engine list filter by interpolating the rawUserIDdirectly into a quoted AIP-160 string literal:A double-quote character in
UserIDbreaks out of the quoted value and lets a caller append arbitrary AIP-160 predicates. For example aUserIDofattacker" OR userId!="produces the filter:Since
userId!=""matches every session with a non-empty user id, this returns sessions belonging to all users of the same Agent Engine deployment (cross-user session enumeration). Each returned session exposes its id, user id, last update time, and state.This is the Go counterpart of an issue previously reported and fixed in adk-python — see google/adk-python#5270 / PR google/adk-python#5273 (merged as
bdece00), where the same unescaped-user_idinterpolation was fixed with a filter-literal quoting helper. I noticed the same pattern here while reviewing the sibling port and am proposing the equivalent fix.Solution
Add a small
quoteFilterLiteralhelper that escapes backslashes first, then double-quotes, so the whole value stays inside the AIP-160 string literal regardless of what is passed in, and use it when building the filter:Testing Plan
Unit tests
Added
session/vertexai/filter_test.gowith table-driven coverage forquoteFilterLiteral:alice->"alice"attacker" OR userId!="->"attacker\" OR userId!=\""\->"\\"""Manual validation (filter-string transformation)
main, aUserIDofattacker" OR userId!="produces the filteruserId="attacker" OR userId!=""— the injectedOR userId!=""predicate is live and returns every user's sessions.userId="attacker\" OR userId!=\""— the metacharacters stay inside the quoted literal and the filter matches only the literal (non-existent) user.Additional context
Small, focused fix that keeps the current filter-construction approach but ensures
UserIDremains data instead of altering the filter expression. Mirrors the escaping order used in the merged adk-python fix (backslashes first, then double quotes).