[rmcdaniel]

Follow-up from the security review of #243. Refs durable-workflow/.github#212. It is kept separate from #243 as requested.

Problem: describe_workflow and update_workflow_response built their paths with the raw workflow_id (and update name). A /, ? or # in an id addressed a different route, and .. collapsed /workflows/.. onto another one.

Change

• New path_segment(field, value) helper. It percent-encodes the value the same way as RawRequest segments and refuses an empty, . or .. value with the new Error::InvalidPathSegment { field }.
• describe_workflow encodes workflow_id. update_workflow / update_workflow_avro_value encode workflow_id and update_name, and the check runs before any request, including payload-policy discovery.
• CHANGELOG entry under Unreleased.

Tests: ids containing /, ?, # and spaces stay in one encoded segment for describe and update. Empty, . and .. workflow ids and update names are refused with nothing sent.

Local (rust 1.86.0 in Docker): cargo fmt --check, cargo test --locked --all-targets --all-features (976 passed, 0 failed), doctests, and cargo doc -D warnings all clean.

Not covered: ten other control-plane paths still interpolate ids raw: signal, query, workflow commands (cancel/terminate/…), redrive, message streams and describe_workflow_run. They need the same treatment in a follow-up.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS at 0a1dce7 (CI 17 passed, 2 skipped). path_segment refuses empty, . and .. with Error::InvalidPathSegment before percent-encoding. describe_workflow and update_workflow now use it for the workflow id and update name. The tests cover / ? # and spaces staying in one encoded segment. Please file the follow-up for the remaining ten raw-id routes (signal, query, cancel and the other commands, redrive, message streams, describe_run) and apply the same helper there. Those are the same class of path confusion.