Feat: Implement robust path validation and structured skip reporting

[thiyaguk09]

BREAKING CHANGE: downloadManyFiles now returns a DownloadManyFilesResult object
instead of an array of DownloadResponse.

• Implements strict blocking for absolute paths (Unix and Windows styles).
• Prevents path traversal via dot-segments (../) using path.relative validation.
• Blocks illegal characters and poisoned paths (e.g., Windows volume colons).
• Updates internal logic to resolve paths against a safe base directory (CWD or prefix).

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

Description

Please provide a detailed description for the change.
As much as possible, please try to keep changes separate by purpose. For example, try not to make a one-line bug fix in a feature request, or add an irrelevant README change to a bug fix.

Impact

What's the impact of this change?

Testing

Have you added unit and integration tests if necessary?
Were any tests changed? Are any breaking changes necessary?

Additional Information

Any additional details that we should be aware of?

Checklist

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease
• Appropriate docs were updated
• Appropriate comments were added, particularly in complex areas or places that require background
• No new warnings or issues will be generated from this change

Fixes #issue_number_goes_here 🦕

[gemini-code-assist]

Summary of Changes

Hello @thiyaguk09, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the security of the downloadManyFiles function by introducing comprehensive path validation. The changes aim to prevent various forms of path traversal attacks, ensuring that downloaded files are always placed in safe, designated directories. Additionally, the function's return type has been updated to provide a more structured result, including explicit reporting for any files that were skipped due to validation failures, improving transparency and error handling for users.

Highlights

• Breaking Change: downloadManyFiles Return Type: The downloadManyFiles function now returns a DownloadManyFilesResult object, which includes both the successful download responses and a list of any skipped files, instead of just an array of DownloadResponse.
• Robust Path Validation: Implemented strict path validation to prevent path traversal vulnerabilities. This includes blocking absolute paths (Unix and Windows styles), preventing dot-segments (../), and disallowing illegal characters or 'poisoned paths' (e.g., Windows volume colons).
• Safe Base Directory Resolution: All download paths are now resolved against a safe base directory, which is either the current working directory (CWD) or a specified prefix, to ensure files are written only to intended locations.
• Structured Skipped File Reporting: The new DownloadManyFilesResult object provides a skippedFiles array, detailing which files were not downloaded and the reason for skipping them (e.g., 'Path Traversal Detected').
• Comprehensive Unit Tests: Extensive unit tests have been added to cover various path traversal scenarios, including malicious filenames, absolute paths, and Windows-specific path attacks, ensuring the new validation logic is robust.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[thiyaguk09]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces robust path validation and structured skip reporting to the downloadManyFiles function in the TransferManager. It enhances security by preventing path traversal vulnerabilities and illegal character usage, while also providing more informative feedback on skipped files. The changes include modifications to the samples/downloadManyFilesWithTransferManager.js, src/file.ts, src/transfer-manager.ts, and test/transfer-manager.ts files. The most significant changes are in src/transfer-manager.ts, where path validation logic is implemented to prevent path traversal attacks.

[gemini-code-assist]

Code Review

This pull request introduces robust path validation and a structured reporting mechanism for skipped files in the downloadManyFiles function. The changes include blocking absolute paths, preventing path traversal via dot-segments, and filtering out illegal characters like Windows volume colons. This is a breaking change, as downloadManyFiles now returns a DownloadManyFilesResult object. The new interfaces and updated sample code reflect this change, and comprehensive tests have been added to ensure the security and correctness of the path validation logic.

[thiyaguk09]

/gemini review