fix(common): preserve `DEFAULT_PROJECT_ID_TOKEN` in `joinURIComponents()` by akiliscodes · Pull Request #9315 · googleapis/google-cloud-node

akiliscodes · 2026-09-13T16:52:48Z

Summary

Preserve DEFAULT_PROJECT_ID_TOKEN when building request URIs with joinURIComponents() so lazy project ID resolution can still replace the placeholder before the request is sent.

Problem

#9188 hardened joinURIComponents() against path traversal by encoding path components with encodeURIPath().

This also causes the internal DEFAULT_PROJECT_ID_TOKEN placeholder ({{projectId}}) to be encoded as %7B%7BprojectId%7D%7D.

Project ID substitution happens later, when decorateRequest() calls replaceProjectIdToken(). Because that function looks for the literal {{projectId}} token, it can no longer recognize the encoded placeholder.

As a result, clients relying on lazy project ID resolution can send the encoded placeholder to the backend instead of the resolved project ID, causing the request to fail.

Reported in #9256.

Fix

Update joinURIComponents() to preserve DEFAULT_PROJECT_ID_TOKEN when a trimmed path component exactly matches the library-owned token.

Only this exact internal constant bypasses encoding. All other path components continue through encodeURIPath(), preserving the path-traversal protection introduced in #9188.

This allows the existing request flow to work as intended:

joinURIComponents()
  → preserves {{projectId}}

decorateRequest()
  → replaceProjectIdToken()
  → substitutes the resolved project ID

Testing

Added coverage for both the regression and the existing URI-encoding behavior:

test/util.ts
- verifies that DEFAULT_PROJECT_ID_TOKEN survives joinURIComponents() and can subsequently be replaced by replaceProjectIdToken()
- verifies that token-like user-controlled segments such as {{../../admin}} do not bypass encoding/path-traversal protection
- verifies that regular path components containing special characters are still encoded
test/service.ts
- verifies that Service.request_() preserves the literal {{projectId}} placeholder until the request-decoration phase when no explicit project ID is provided

Checklist

Opened an issue first — @google-cloud/[email protected] security patch breaks ADC project ID detection — joinURIComponents() encodes DEFAULT_PROJECT_ID_TOKEN before replaceProjectIdToken() runs #9256
Tests and linter pass
Code coverage does not decrease
Appropriate docs were updated (if necessary)

Fixes #9256 🦕

google-cla · 2026-09-13T16:52:59Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

gemini-code-assist

Code Review

This pull request addresses a regression where the DEFAULT_PROJECT_ID_TOKEN was encoded, breaking lazy/ADC project-ID resolution. The changes update joinURIComponents to bypass encoding for this token and add corresponding unit tests. The review feedback points out two critical issues: a missing import of replaceProjectIdToken in the test file, and a potential circular dependency if DEFAULT_PROJECT_ID_TOKEN is imported from service into util. The reviewer suggests moving the token definition to util.ts to resolve the circular dependency cleanly.

encodeURIPath encodes '{{projectId}}' as '%7B%7BprojectId%7D%7D', which prevents replaceProjectIdToken() from finding and substituting the placeholder later in the request lifecycle (decorateRequest → makeAuthenticatedRequest). Skip encoding when the trimmed component equals DEFAULT_PROJECT_ID_TOKEN so that ADC / lazy project-ID resolution continues to work for clients that do not supply an explicit projectId (e.g. new BigQuery()). Regression introduced by googleapis#9188. Fixes googleapis#9256.

…mponents

akiliscodes · 2026-10-02T19:32:04Z

/gemini review

gemini-code-assist

Code Review

This pull request fixes a regression where the DEFAULT_PROJECT_ID_TOKEN was being encoded by joinURIComponents, breaking lazy project-ID resolution for ADC clients. The changes bypass encoding for this token and add corresponding unit tests. Feedback on the changes highlights two critical issues: first, referencing DEFAULT_PROJECT_ID_TOKEN in util.ts introduces a circular dependency with service.ts that could cause the token to be undefined at runtime; second, the test file core/common/test/util.ts is missing an import for replaceProjectIdToken, which will result in a ReferenceError during test execution.

gemini-code-assist · 2026-10-02T19:34:08Z

-      const trimSlashesRegex = /^\/*|\/*$/g;
-      const trimmed = uriComponent.replace(trimSlashesRegex, '');
+      const trimmed = uriComponent.replace(/^\/*|\/*$/g, '');
+      if (trimmed === DEFAULT_PROJECT_ID_TOKEN) return trimmed;


Using DEFAULT_PROJECT_ID_TOKEN in util.ts introduces a circular dependency between util.ts and service.ts (since service.ts imports util.ts and util.ts imports service.ts). In Node.js, circular dependencies can cause imported constants to be undefined during module initialization. If DEFAULT_PROJECT_ID_TOKEN is undefined when util.ts is evaluated, the comparison trimmed === DEFAULT_PROJECT_ID_TOKEN will silently fail, and the token will be encoded anyway, defeating the fix.

To prevent this, please define DEFAULT_PROJECT_ID_TOKEN in util.ts (or a separate constants file) and export it from there. Then, service.ts can import it from util.ts and re-export it to maintain backward compatibility.

gemini-code-assist · 2026-10-02T19:34:08Z

+  joinURIComponents,
 } from '../src/util';


The test uses replaceProjectIdToken to verify that the placeholder is correctly substituted, but replaceProjectIdToken is not imported from ../src/util. This will cause a ReferenceError when running the tests. Please add replaceProjectIdToken to the import list.

Suggested change

joinURIComponents,

} from '../src/util';

joinURIComponents,

replaceProjectIdToken,

} from '../src/util';

gemini-code-assist Bot reviewed Sep 13, 2026

View reviewed changes

Comment thread core/common/test/util.ts

Comment thread core/common/src/util.ts

akiliscodes added 2 commits September 13, 2026 22:40

Merge branch 'main' into fix/preserve-project-id-token-in-join-uri-co…

8e247fb

…mponents

akiliscodes force-pushed the fix/preserve-project-id-token-in-join-uri-components branch from ba0c03b to 8e247fb Compare September 13, 2026 20:44

akiliscodes marked this pull request as ready for review September 13, 2026 20:54

akiliscodes requested a review from a team as a code owner September 13, 2026 20:54

github-actions Bot requested a review from shivanee-p September 13, 2026 20:54

Merge branch 'main' into fix/preserve-project-id-token-in-join-uri-co…

6f6fc64

…mponents

shivanee-p removed their request for review September 21, 2026 16:21

Merge branch 'main' into fix/preserve-project-id-token-in-join-uri-co…

7a1aadd

…mponents

github-actions Bot requested a review from bshaffer September 22, 2026 03:01

akiliscodes added 3 commits September 23, 2026 09:14

Merge branch 'main' into fix/preserve-project-id-token-in-join-uri-co…

3dcd576

…mponents

Merge branch 'main' into fix/preserve-project-id-token-in-join-uri-co…

210e7bd

…mponents

Merge branch 'main' into fix/preserve-project-id-token-in-join-uri-co…

b5ab899

…mponents

TorbenWetter mentioned this pull request Oct 1, 2026

@google-cloud/[email protected] security patch breaks ADC project ID detection — joinURIComponents() encodes DEFAULT_PROJECT_ID_TOKEN before replaceProjectIdToken() runs #9256

Open

gemini-code-assist Bot reviewed Oct 2, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(common): preserve `DEFAULT_PROJECT_ID_TOKEN` in `joinURIComponents()` - #9315

fix(common): preserve `DEFAULT_PROJECT_ID_TOKEN` in `joinURIComponents()`#9315
akiliscodes wants to merge 7 commits into
googleapis:mainfrom
akiliscodes:fix/preserve-project-id-token-in-join-uri-components

akiliscodes commented Sep 13, 2026 •

edited

Loading

Uh oh!

google-cla Bot commented Sep 13, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

akiliscodes commented Oct 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Oct 2, 2026

Uh oh!

gemini-code-assist Bot Oct 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

akiliscodes commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

Fix

Testing

Checklist

Uh oh!

google-cla Bot commented Sep 13, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

akiliscodes commented Oct 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

akiliscodes commented Sep 13, 2026 •

edited

Loading