8.3.1

Kontent.ai .NET Management SDK 8.3.1

Security hotfix. Recommended for all 8.x users.

Security

Path traversal via unescaped identifiers

Some resource identifiers (codenames, emails, and upload file names) were inserted into Management API request paths without escaping, so a caller-supplied value containing path-traversal characters could retarget a request to a different Management API endpoint under the same API key.

Identifier values are now consistently encoded and validated as a single URL path segment before the request is sent, so they can no longer affect which endpoint a request targets.

Notes

• Minor wire change: identifier values are now percent-encoded consistently, so an email goes out as e.g. test%40kontent.ai instead of test@kontent.ai. The Management API decodes these identically — no action needed.
• Some malformed identifier values now throw ArgumentException; ordinary values continue to work unchanged.
• No public API surface changed and no members were removed.

Full Changelog: 8.3.0...8.3.1