{"record":{"id":"510d9608cb9bde51","repo":"microsoft/semantic-kernel","slug":"path-path-contains-a-dot-segment-which-could-510d96","errorCode":null,"errorMessage":"Path '{path}' contains a dot-segment, which could lead to path traversal.","messagePattern":"Path '(.+?)' contains a dot-segment, which could lead to path traversal\\.","errorType":"exception","errorClass":"FunctionExecutionException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py","lineNumber":343,"sourceCode":"                if parameter.is_required:\n                    raise FunctionExecutionException(\n                        f\"No argument is provided for the `{parameter.name}` \"\n                        f\"required parameter of the operation - `{self.id}`.\"\n                    )\n                continue\n            path_template = path_template.replace(f\"{{{parameter.name}}}\", quote(str(argument), safe=\"\"))\n        self._validate_path_segments(path_template)\n        return path_template\n\n    @staticmethod\n    def _validate_path_segments(path: str) -> None:\n        \"\"\"Reject dot-segments (. or ..), including percent-encoded forms, that enable path traversal.\n\n        The operation is selected using the raw path but the request URL is built from a canonicalized\n        path, so encoded dot-segments such as \"%2e%2e\" must be rejected before the URL is constructed.\n        \"\"\"\n        if RestApiOperation._contains_dot_segment(path):\n            raise FunctionExecutionException(\n                f\"Path '{path}' contains a dot-segment, which could lead to path traversal.\"\n            )\n\n    @staticmethod\n    def _contains_dot_segment(path: str) -> bool:\n        \"\"\"Return True if the path contains a dot-segment (. or ..), including percent-encoded forms.\n\n        Used both to reject such paths when building a request URL and to exclude them during operation\n        selection so an encoded dot-segment cannot bypass an include/exclude operation-selection filter.\n        \"\"\"\n        if not path:\n            return False\n        for segment in path.split(\"/\"):\n            decoded = segment\n            for _ in range(5):\n                unescaped = unquote(decoded)\n                if unescaped == decoded:\n                    break","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py#L325-L361","documentation":"A security validation: `_validate_path_segments` rejects any operation path containing dot-segments (`.` or `..`), including percent-encoded forms like `%2e%2e`. This prevents path traversal attacks where an interpolated argument or spec path could escape the intended URL hierarchy. The check decodes percent-encoding up to five levels deep and re-splits on encoded separators to catch obfuscated traversal attempts.","triggerScenarios":"A path argument value or operation path template contains `.` or `..` segments, or percent-encoded equivalents (`%2e`, `%2e%2e`, `%2E%2E`). This can come from user-supplied path parameter values being interpolated into the URL path.","commonSituations":"A path parameter value like `../admin` or `..%2f..%2fconfig` supplied by a user or client. An OpenAPI spec path template inadvertently contains dot-segments. Security testing / fuzzing of the API.","solutions":["Sanitize path parameter values to remove `.` and `..` segments before passing them as arguments.","Reject or validate user input that contains path traversal sequences.","Review the OpenAPI spec for any path templates containing dot-segments and correct them."],"exampleFix":"// before (user-supplied path param with traversal)\nawait api.get_file(file_id=\"../../etc/passwd\")\n// after\n# validate/sanitize input before calling\nimport re\nclean = re.sub(r'(\\.+/)+', '', file_id)\nawait api.get_file(file_id=clean)","handlingStrategy":"validation","validationCode":"import re\ndef sanitize_path_segment(value: str) -> str:\n    \"\"\"Reject or strip dot-segments from a path parameter value.\"\"\"\n    from urllib.parse import unquote\n    decoded = value\n    for _ in range(5):\n        nxt = unquote(decoded)\n        if nxt == decoded:\n            break\n        decoded = nxt\n    for part in decoded.replace('\\\\', '/').split('/'):\n        if part in ('.', '..'):\n            raise ValueError(f\"Path value '{value}' contains a dot-segment (path traversal)\")\n    return value","typeGuard":null,"tryCatchPattern":"try:\n    result = await api.my_operation(**args)\nexcept FunctionExecutionException as e:\n    if \"dot-segment\" in str(e):\n        # sanitize the offending path parameter value\n        ...","preventionTips":["Sanitize all user-supplied path parameter values for dot-segments before passing them.","Reject input containing '.', '..', or percent-encoded equivalents.","Review OpenAPI spec path templates for accidental dot-segments."],"tags":["openapi","rest-api","security","path-traversal","semantic-kernel"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}