[fix][sec] Prevent path traversal in PackageName toRestPath

[Praveenkumar76]

Fixes #25323

Motivation

A potential path traversal vulnerability (CWE-22) exists in PackageName.toRestPath().

The method builds REST path segments using package fields such as tenant, namespace, name, and version. These values were previously concatenated directly into the generated path without URL encoding.

Although current constructor validation blocks malformed input (like extra slashes) in normal flows, relying only on upstream validation violates the principle of Defense in Depth. If object construction is bypassed through reflection, deserialization, future code changes, or alternate call paths, malicious values containing traversal sequences such as ../ could be propagated directly into generated REST paths.

This change applies defense-in-depth by ensuring toRestPath() safely encodes path components according to RFC 3986 before constructing the final path.

Modifications

• Updated PackageName.toRestPath() to safely encode:

  • tenant
  • namespace
  • name
  • version

• Used Guava's UrlEscapers.urlPathSegmentEscaper().escape(...) to construct the components. This correctly follows RFC 3986 for URL paths (converting spaces to %20 and slashes to %2F) and avoids the + space-encoding issue caused by standard URLEncoder, without requiring new external HTTP dependencies.

• Added a reflection-based unit test (testPathTraversalBypassConstructor) to explicitly verify traversal payloads are encoded safely even when constructor validation is bypassed.

Verifying this change

This change added tests and can be verified as follows:

• Ran package management module tests successfully.
• Added a test that injects traversal-like values (for example ../../) and verifies the output path is safely encoded.
• Confirmed normal package name inputs continue to behave correctly.

Example verification command:

./gradlew :pulsar-package-management:pulsar-package-core:test --tests "PackageNameTest"

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

[Copilot]

Pull request overview

Hardens PackageName.toRestPath() against CWE-22 path traversal by percent-encoding each REST path component, adding a regression test intended to validate safety even when constructor validation is bypassed.

Changes:

• Encode tenant, namespace, name, and version in PackageName.toRestPath() using Guava UrlEscapers.urlPathSegmentEscaper().
• Add a reflection-based unit test that injects traversal-like content into tenant and asserts the resulting REST path is safely encoded.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
pulsar-package-management/core/src/main/java/org/apache/pulsar/packages/management/core/common/PackageName.java	Escapes REST path components to prevent path traversal through untrusted/malicious values.
pulsar-package-management/core/src/test/java/org/apache/pulsar/packages/management/core/common/PackageNameTest.java	Adds a test intended to prove traversal payloads are encoded even if object state is tampered with via reflection.

[lhotari]

LGTM

[lhotari]

Thanks for the contribution @Praveenkumar76

[lhotari]

chore: trigger CI to retry flaky broker test

To retry CI after it fails due to flaky tests, add a comment /pulsarbot rerun instead.