{"record":{"id":"29284f273b218fe6","repo":"openai/openai-python","slug":"constructed-path-path-result-r-contains-dot-segm","errorCode":null,"errorMessage":"Constructed path {path_result!r} contains dot-segment {segment!r} which is not allowed","messagePattern":"Constructed path (.+?) contains dot-segment (.+?) which is not allowed","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"src/openai/_utils/_path.py","lineNumber":119,"sourceCode":"\n    rest = template\n    if \"#\" in rest:\n        rest, fragment_template = rest.split(\"#\", 1)\n    if \"?\" in rest:\n        rest, query_template = rest.split(\"?\", 1)\n    path_template = rest\n\n    # Interpolate each portion with the appropriate quoting rules.\n    path_result = _interpolate(path_template, kwargs, _quote_path_segment_part)\n\n    # Reject dot-segments (. and ..) in the final assembled path.  The check\n    # runs after interpolation so that adjacent placeholders or a mix of static\n    # text and placeholders that together form a dot-segment are caught.\n    # Also reject percent-encoded dot-segments to protect against incorrectly\n    # implemented normalization in servers/proxies.\n    for segment in path_result.split(\"/\"):\n        if _DOT_SEGMENT_RE.match(segment):\n            raise ValueError(f\"Constructed path {path_result!r} contains dot-segment {segment!r} which is not allowed\")\n\n    result = path_result\n    if query_template is not None:\n        result += \"?\" + _interpolate(query_template, kwargs, _quote_query_part)\n    if fragment_template is not None:\n        result += \"#\" + _interpolate(fragment_template, kwargs, _quote_fragment_part)\n\n    return result\n","sourceCodeStart":101,"sourceCodeEnd":128,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/_utils/_path.py#L101-L128","documentation":"After interpolating a URL path template, the SDK validates that no single slash-delimited segment is a dot-segment ('.', '..', or percent-encoded equivalents). This ValueError protects against path-traversal-style constructed URLs: interpolated values that are '..' (or that concatenate with static text to form '.') could make the request escape the intended resource path. It fires client-side before any network request is made.","triggerScenarios":"Passing an id/path parameter equal to '..', '.', '%2e%2e', or a value that combined with adjacent template text forms a dot-segment, e.g. id='.x'/value where 'foo/{id}' yields a segment starting with a dot matching the DOT_SEGMENT regex; also test-driven checks of the validation itself.","commonSituations":"Using user-supplied or filesystem-derived identifiers verbatim as path params; sanitizing or truncating ids in a way that leaves '.' or '..'; migrating code that previously joined path components manually.","solutions":["Reject or sanitize user-supplied path parameters: strip leading dots and reject '..' before calling the API","Validate ids against an expected pattern (e.g. ^[A-Za-z0-9_-]+$) before passing them","URL-encode path parameters through the SDK's supported mechanisms instead of manual string building","Return a 400 to your own caller when an invalid id is detected rather than attempting the request"],"exampleFix":"# before\nclient.things.get(thing_id=user_input)  # user_input = '..'\n\n# after\nimport re\nif not re.fullmatch(r\"[A-Za-z0-9_-]+\", user_input):\n    raise ValueError(\"invalid id\")\nclient.things.get(thing_id=user_input)","handlingStrategy":"type-guard","validationCode":"import re\nDOT = re.compile(r\"^(\\.|%2e|%2E)+$\")\nif any(DOT.fullmatch(seg) or seg in (\".\", \"..\") for seg in value.split(\"/\")):\n    raise ValueError(\"unsafe id\")","typeGuard":"import re\nSAFE_ID = re.compile(r\"^[A-Za-z0-9_-]+$\")\ndef is_safe_path_id(v: str) -> bool: return bool(SAFE_ID.fullmatch(v))","tryCatchPattern":"try:\n    client.things.get(thing_id=rid)\nexcept ValueError as e:\n    return HTTPException(400, \"invalid identifier\")","preventionTips":["Validate user-supplied ids against a whitelist regex","Never build API paths via string concatenation","Reject ids containing '/', '.', or percent-encoding at input"],"tags":["path-traversal","url-validation","security","valueerror"],"backgroundTag":"path-traversal-blocked","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}