adk web GET/DELETE test endpoints skip the create_test path sanitiser

Aperta

#7,033 aperta il 6/9/2026 5 commenti 0 reazioni 1 assegnatario Vedi su GitHub

@surajksharma07 ci sta già lavorando.

Dal 7/9/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

request clarification web

Expected Behavior

create_test strips directories from test_name with os.path.basename so a name cannot leave the app tests/ folder.

GET, DELETE, and rebuild of a single test should use the same rule.

Actual Behavior

On main @ b018062, only create_test calls os.path.basename. delete_test, get_test_content, and rebuild_app_tests join test_name as given.

A percent-encoded path segment ../outside.json (%2e%2e%2foutside.json) on DELETE/GET is joined onto tests/ and can read or remove a JSON file in the agent directory, outside tests/.

rebuild?test_name=../outside.json does the same for the rebuild path.

This is the local adk web server. It is unauthenticated. Default bind is loopback. It still matters when --host 0.0.0.0 is used, or when anything else can hit those routes.

Steps to Reproduce

adk web (or the TestClient in tests/unittests/cli/test_adk_web_server_tests.py)
Put outside.json in the agent directory, not in tests/
DELETE /dev/apps/<app>/tests/%2e%2e%2foutside.json
On current main, that file is removed. After sanitising with basename, the request 404s and the file stays.

I can send a PR that shares one helper with create_test and adds those cases to test_adk_web_server_tests.py.

Lingua principale: Python
Stelle: 21.6k
Fork: 4k
Merge medio: 13h 49m
PR unite (30g): 10

Guida per i contributori

Apri la guida per i contributori

Come iniziare

Leggi tutta la issue e poi la guida ai contributi del progetto.
Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
Fai un fork del repository e lavora su un branch.
Apri una pull request che faccia riferimento al numero della issue.