fix(services): support api:version syntax for unlisted Discovery APIs by nuthalapativarun · Pull Request #826 · googleworkspace/cli

nuthalapativarun · 2026-06-01T03:14:23Z

Summary

When a user passes gws admob:v1 ..., parse_service_and_version now falls through to use the raw API name and version rather than returning an error for unknown service aliases. The original error is still returned when no version override is present.

Fixes #670

Changes

crates/google-workspace-cli/src/main.rs: when resolve_service fails but a version override is present, use the raw service arg as the API name
Added regression test in the #[cfg(test)] block covering the admob:v1 unlisted API case

Checklist

cargo fmt --all passed (CI)
cargo clippy -- -D warnings passed (CI)
cargo test passed (CI)
Changeset file added (patch bump)

…APIs When resolve_service fails but a version override is present (via colon syntax or --api-version flag), fall through to use the raw service arg as the API name with the provided version instead of returning an error. Fixes googleworkspace#670

changeset-bot · 2026-06-01T03:14:27Z

🦋 Changeset detected

Latest commit: 5aebd68

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

gemini-code-assist · 2026-06-01T03:14:33Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the flexibility of the CLI by enabling support for unlisted Discovery APIs. By modifying the service resolution logic, the tool now correctly handles service arguments that include a version override, even if the service itself is not present in the internal known services list. This ensures that users can interact with a broader range of Google APIs without requiring explicit registration in the CLI.

Highlights

API Version Resolution: Updated the service resolution logic to allow the use of unlisted Discovery APIs when a version override is explicitly provided via the : syntax.
Regression Testing: Added a new unit test to verify that unlisted services like 'admob:v1' are correctly parsed when a version is specified.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Generative AI Prohibited Use Policy, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request fixes the <api>:<version> syntax handling to allow unlisted Discovery APIs to be called directly. It updates parse_service_and_version to fall back to the service argument and version override if the service resolution fails, and adds a corresponding unit test. The reviewer identified an issue where the --api-version=VER syntax (using an equals sign) is ignored in parse_service_and_version, causing unlisted APIs using this syntax to fail, and provided a code suggestion to resolve this inconsistency.

…ed APIs The version-override loop only matched the space-separated form (--api-version VER). Add a strip_prefix branch to also capture the equals-sign form (--api-version=VER), which filter_args_for_subcommand already stripped but parse_service_and_version silently ignored. Add a test to cover the equals-sign path with an unlisted service.

googleworkspace-bot · 2026-06-01T04:23:30Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for calling unlisted Discovery APIs directly by updating the argument parsing logic to handle the <api>:<version> syntax and the --api-version= flag format. When a service is not found in the pre-defined list, the parser now falls back to using the raw service argument and the provided version override. The review feedback identifies a potential path traversal and terminal escape sequence injection vulnerability resulting from allowing arbitrary unlisted service names and versions, and suggests implementing strict character validation to mitigate these security risks.

…path traversal Add alphanumeric + _-. allowlist check when falling back to a raw service name and version for unlisted Discovery APIs. Rejects inputs containing ../ traversal sequences or special URL characters before they can reach the Discovery URL or filesystem cache. Resolves Gemini r2 comment on PR googleworkspace#826.

googleworkspace-bot · 2026-06-01T16:24:58Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for the --api-version=<version> flag syntax and enables calling unlisted Discovery APIs directly by validating the service name and version when they are not in the known services list. The review feedback identifies a critical security vulnerability where the version_override is not validated when a listed service is successfully resolved, potentially allowing path traversal attacks. A code suggestion is provided to ensure the version override is validated in all code paths.

…nt path traversal Apply the same alphanumeric+dot/dash validation to version_override in the listed-service (Ok) branch that was already applied in the unlisted-service fallback. A malicious caller could previously pass --api-version=../evil to a known service like drive and bypass the check. Also extract is_valid_api_token as a shared closure to remove duplication.

googleworkspace-bot · 2026-06-02T15:33:13Z

/gemini review

gemini-code-assist

Code Review

This pull request fixes the <api>:<version> syntax to allow unlisted Discovery APIs to be called directly, supports the --api-version= flag format, and adds input validation to prevent path traversal. A security review identified a vulnerability in the is_valid_api_token helper, which currently permits tokens consisting entirely of dots (such as . or ..), and recommended a code improvement to explicitly reject them.

gemini-code-assist · 2026-06-02T15:34:19Z

+    let is_valid_api_token = |s: &str| {
+        !s.is_empty()
+            && s.chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-' || c == '.')
+    };


The is_valid_api_token helper allows tokens consisting entirely of dots (such as . or ..) because . is in the allowed character set. This can lead to path traversal vulnerabilities or unexpected behavior if a malicious service name or version override like .. is supplied.

To prevent this, explicitly reject tokens that start with a dot or contain consecutive dots (..).

let is_valid_api_token = |s: &str| { !s.is_empty() && !s.starts_with('.') && !s.contains("..") && s.chars() .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-' || c == '.') };

googleworkspace-bot added the area: core Core CLI parsing, commands, error handling, utilities label Jun 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(services): support api:version syntax for unlisted Discovery APIs#826

fix(services): support api:version syntax for unlisted Discovery APIs#826
nuthalapativarun wants to merge 4 commits into
googleworkspace:mainfrom
nuthalapativarun:fix/670-api-version-syntax

nuthalapativarun commented Jun 1, 2026

Uh oh!

changeset-bot Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

googleworkspace-bot commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

googleworkspace-bot commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

googleworkspace-bot commented Jun 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nuthalapativarun commented Jun 1, 2026

Summary

Changes

Checklist

Uh oh!

changeset-bot Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

gemini-code-assist Bot commented Jun 1, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

googleworkspace-bot commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

googleworkspace-bot commented Jun 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

googleworkspace-bot commented Jun 2, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Jun 1, 2026 •

edited

Loading