Python: OpenAPI plugin: encoded dot-segment path canonicalization bypasses operation selection (.NET and Python)

[rogerbarreto]

Summary

The .NET and Python OpenAPI plugins select operations using the raw OpenAPI path, but build the runtime request URL from a canonicalized path. Encoded dot-segments (for example /resources/%2e%2e/admin) pass an OperationSelectionPredicate path check, yet System.Uri (.NET) / urljoin (Python) collapse them to a different route at request time. The selected path and the actual request target can therefore diverge.

Affected

• .NET: Functions.OpenApi — RestApiOperation.ValidatePathSegments only rejects literal ./.. segments; encoded forms are not decoded before URI build.
• Python: connectors/openapi_plugin — no dot-segment validation; urljoin resolves .. traversal.

Expected

Operation selection, path-segment validation, and request building should use one consistent canonical path interpretation. Encoded dot-segment paths should be rejected before a request can be built.

Plan

• Decode-then-reject dot-segment validation (handle %2e%2e, mixed case, encoded slashes, double-encoding).
• Validate at import/parse time and at URL build time.
• Defense-in-depth check that the built URL still matches the selected operation path.
• Regression tests on both .NET and Python that go red then green (test harness covering the failing cases).