[Mangesh Raut (mangeshraut712)]

Summary

• Decode %2e/%2E and apply RFC 3986 remove_dot_segments before allowed_base_urls path-prefix matching
• Closes the gap where /api/../admin and /api/%2e%2e/admin matched an /api allowlist while httpx would request /admin
• Empty segments (//) preserved to match httpx; other percent-encodings left intact

Tests

• Rejects .. and %2e%2e escapes under an /api allowlist
• Still allows /api/./users, /api/users, /api, /api/
• Still rejects /apiusers (shared prefix chars only)

Fixes #14662

[Copilot]

🟡 Changes recommended

Path-scope bypasses remain, and terminal dot segments lose trailing slashes required for correct allowlist matching.

3 open issues

• Prevent internal empty segments from bypassing path allowlist · New
• Validate both wire and decoded paths against allowlist · New
• Preserve trailing slash during dot-segment normalization · New

What changed in this PR

This PR hardens Python OpenAPI URL allowlist validation against same-host path escapes, addressing issue #14662.

Changes:

• Normalizes request and allowlist paths before prefix matching.
• Decodes percent-encoded dots and resolves dot segments while preserving empty segments.
• Adds tests for traversal attempts, valid paths, and prefix boundaries.

File	Description
python/​tests/​unit/​connectors/​openapi_plugin/​test_server_url_validator.py	Adds rejection and acceptance regression cases.
python/​semantic_kernel/​connectors/​openapi_plugin/​server_url_validator.py	Adds path normalization to allowlist prefix matching.

_{Review effort: Balanced}

[Mangesh Raut (mangeshraut712)]

Rebased onto latest main (CI re-running). Ready for review/merge when you have a chance — thanks.

[adeeluddin01]

Thanks for picking this up — confirming the core bug from #14662: a dot-segment path can escape an /api allowlist while the HTTP client sends a different path. Two gaps worth closing before merge: (1) Both the wire path and the decoded path should satisfy the allowlist. E.g. /admin/%2e%2e/api normalizes to /api and would be accepted, but on a server that does not decode, the wire path stays under /admin — checking the decoded path alone is fail-open in that direction, even though the original issue's fails-closed claim held in the decode direction. (2) Trailing-slash handling: /api/. and /api/users/.. normalize to bare /api, so an /api/ allowlist wrongly rejects them and an /api/. allowlist wrongly permits bare /api. Either preserve the trailing slash through normalization or define explicitly that /api and /api/ are treated the same.

[Mangesh Raut (mangeshraut712)]

Eduard van Valkenburg (@eavanvalkenburg) Thanks. Merged main to clear the conflict and pushed 402c752: the validator now normalizes to the same target httpx 0.28.1 actually sends, so /api/. and /api/users/.. are checked as /api. Added tests for those cases plus a runner-level test that the allowlist is enforced on the wire target.