Skip to content

Quote user_id literals in VertexAiSessionService list filters#5273

Closed
petrmarinec wants to merge 5 commits intogoogle:mainfrom
petrmarinec:fix-vertex-session-filter-escaping
Closed

Quote user_id literals in VertexAiSessionService list filters#5273
petrmarinec wants to merge 5 commits intogoogle:mainfrom
petrmarinec:fix-vertex-session-filter-escaping

Conversation

@petrmarinec
Copy link
Copy Markdown
Contributor

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

2. Or, if no issue exists, describe the change:

Problem:
VertexAiSessionService.list_sessions() built an AIP-160 filter by interpolating raw user_id into a quoted string literal. Embedded quotes could break out of that literal and append additional filter syntax.

Solution:
Quote the user_id value before constructing the filter string so embedded quotes and backslashes stay inside the literal. Added a regression test that captures the exact filter passed to the Vertex client for a quote-containing payload.

Testing Plan

Unit Tests:

  • I have added or updated unit tests for my change.
  • All unit tests pass locally.

Passed locally:

  • PYTHONPATH=src pytest tests/unittests/sessions/test_vertex_ai_session_service.py
    • Result: 29 passed

Passed in clean Linux Docker (python:3.11-bookworm):

  • pip install -e '.[test]'
  • PYTHONPATH=src pytest tests/unittests/sessions
    • Result: 170 passed

Manual Validation:

  • On current origin/main, a payload of attacker" OR user_id!="" produced the filter string user_id="attacker" OR user_id!="".
  • On this branch, the same payload produces user_id="attacker\" OR user_id!=\"\"", keeping the metacharacters inside the quoted literal.

Checklist

  • I have read the CONTRIBUTING.md document.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have added tests that prove my fix is effective or that my feature works.
  • New and existing unit tests pass locally with my changes.
  • I have manually tested my changes end-to-end.
  • Any dependent changes have been merged and published in downstream modules.

Additional context

This is a small, focused fix that keeps the current filter construction approach but ensures user_id values remain data instead of altering the filter expression.

@adk-bot adk-bot added the services [Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc label Apr 10, 2026
@rohityan rohityan self-assigned this Apr 13, 2026
@rohityan rohityan added the request clarification [Status] The maintainer need clarification or more information from the author label Apr 13, 2026
@rohityan
Copy link
Copy Markdown
Collaborator

Hi @petrmarinec, Thank you for your contribution! We appreciate you taking the time to submit this pull request. Please fix formatting errors by running autoformat.sh

@DeanChensj DeanChensj added the ready to pull [Status] This PR is ready to be imported back to Google label Apr 21, 2026
copybara-service Bot pushed a commit that referenced this pull request Apr 22, 2026
Merge #5273

### Link to Issue or Description of Change

**1. Link to an existing issue (if applicable):**

- Related: #5270

**2. Or, if no issue exists, describe the change:**

**Problem:**
`VertexAiSessionService.list_sessions()` built an AIP-160 filter by interpolating raw `user_id` into a quoted string literal. Embedded quotes could break out of that literal and append additional filter syntax.

**Solution:**
Quote the `user_id` value before constructing the filter string so embedded quotes and backslashes stay inside the literal. Added a regression test that captures the exact filter passed to the Vertex client for a quote-containing payload.

### Testing Plan

**Unit Tests:**

- [x] I have added or updated unit tests for my change.
- [ ] All unit tests pass locally.

Passed locally:
- `PYTHONPATH=src pytest tests/unittests/sessions/test_vertex_ai_session_service.py`
  - Result: `29 passed`

Passed in clean Linux Docker (`python:3.11-bookworm`):
- `pip install -e '.[test]'`
- `PYTHONPATH=src pytest tests/unittests/sessions`
  - Result: `170 passed`

**Manual Validation:**

- On current `origin/main`, a payload of `attacker" OR user_id!=""` produced the filter string `user_id="attacker" OR user_id!=""`.
- On this branch, the same payload produces `user_id="attacker\" OR user_id!=\"\""`, keeping the metacharacters inside the quoted literal.

### Checklist

- [x] I have read the [CONTRIBUTING.md](https://github.com/google/adk-python/blob/main/CONTRIBUTING.md) document.
- [x] I have performed a self-review of my own code.
- [ ] I have commented my code, particularly in hard-to-understand areas.
- [x] I have added tests that prove my fix is effective or that my feature works.
- [ ] New and existing unit tests pass locally with my changes.
- [ ] I have manually tested my changes end-to-end.
- [x] Any dependent changes have been merged and published in downstream modules.

### Additional context

This is a small, focused fix that keeps the current filter construction approach but ensures `user_id` values remain data instead of altering the filter expression.

COPYBARA_INTEGRATE_REVIEW=#5273 from petrmarinec:fix-vertex-session-filter-escaping 4d14a1d
PiperOrigin-RevId: 903926570
@adk-bot
Copy link
Copy Markdown
Collaborator

adk-bot commented Apr 22, 2026

Thank you @petrmarinec for your contribution! 🎉

Your changes have been successfully imported and merged via Copybara in commit bdece00.

Closing this PR as the changes are now in the main branch.

@adk-bot adk-bot closed this Apr 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready to pull [Status] This PR is ready to be imported back to Google request clarification [Status] The maintainer need clarification or more information from the author services [Component] This issue is related to runtime services, e.g. sessions, memory, artifacts, etc

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants