fix(sdk): user id is not escaped in HTTP paths in users.rs #4673

Bug description

core/sdk/src/http/users.rs builds request paths from the user identifier without escaping it:

• :37 get_user: {PATH}/{user_id}
• :90 delete_user: {PATH}/{} with user_id.as_cow_str()
• :101 update_user
• :114 update_permissions
• :131 change_password

A user identifier can be a user name, so it can hold /, ? and #. Over HTTP, delete_user("../streams/1") sends DELETE /streams/1, and a name containing ? is cut at the ?.

Expected: the identifier goes out as one path segment.

The stream, topic and consumer-offset routes already use http::path::encode_segment, and #4628 applies it to the personal access token delete. The same fix applies here. As found in #4628, . and .. still collapse after encoding (Url::join turns %2E%2E into a dot segment), so they need to be rejected before sending.

Only the HTTP transport is affected. TCP, QUIC and WebSocket don't build URLs.

Raised by hubcio in the review of #4628 as a follow-up.

Affected area / component

Rust SDK

Versions

master at d6e42a7cd

Hardware / environment

macOS, local

Sample code

// HTTP client
client.delete_user(&Identifier::from_str_value("../streams/1")?).await?;
// sends DELETE /streams/1

Reproduction

1. Create an HttpClient and log in as a user allowed to delete users.
2. Call delete_user with the identifier ../streams/1.
3. The request goes to DELETE /streams/1.

Not run live. This comes from reading the code and from the same behavior I reproduced for personal access tokens in #4628 (Url::join collapses the dot segments).

Contribution

• I'm willing to submit a pull request to fix this bug