Skip to content

feat(sidekick/rust): decouple option extraction and support resource names#4352

Merged
haphungw merged 4 commits intogoogleapis:mainfrom
haphungw:feat-rust-resource-names
Mar 6, 2026
Merged

feat(sidekick/rust): decouple option extraction and support resource names#4352
haphungw merged 4 commits intogoogleapis:mainfrom
haphungw:feat-rust-resource-names

Conversation

@haphungw
Copy link
Copy Markdown
Contributor

@haphungw haphungw commented Mar 5, 2026

Inject resource name generation into the Rust generator.

Fixes #4183

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request refactors resource name generation in the Rust sidekick by decoupling the creation of resource name arguments from the annotation phase and moving the string formatting into the Rust template. However, the implementation introduces a critical code injection vulnerability. It injects untrusted strings from the API model directly into the generated Rust code without proper sanitization or escaping. Specifically, ResourceNameTemplate and ResourceNameArgs are used in the mustache template with triple braces {{{...}}}, disabling escaping and potentially allowing an attacker to inject arbitrary code. Furthermore, there's an issue in the mustache template's string formatting that will likely cause compilation failures.

Comment thread internal/sidekick/rust/templates/crate/src/transport.rs.mustache
Comment thread internal/sidekick/rust/templates/crate/src/transport.rs.mustache
@haphungw haphungw marked this pull request as ready for review March 6, 2026 00:01
@haphungw haphungw requested a review from a team as a code owner March 6, 2026 00:01
@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 6, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.90%. Comparing base (584600d) to head (15ca95e).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4352      +/-   ##
==========================================
- Coverage   81.91%   81.90%   -0.01%     
==========================================
  Files          99       99              
  Lines        8127     8126       -1     
==========================================
- Hits         6657     6656       -1     
  Misses       1022     1022              
  Partials      448      448              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread internal/sidekick/rust/annotate.go Outdated
Copy link
Copy Markdown
Contributor

@westarle westarle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a draft PR with the resulting code?

Comment thread internal/sidekick/rust/annotate.go Outdated
Comment thread internal/sidekick/rust/annotate.go
@haphungw
Copy link
Copy Markdown
Contributor Author

haphungw commented Mar 6, 2026

Is there a draft PR with the resulting code?

googleapis/google-cloud-rust#4838

I update the generated output for both dns and compute here.

@haphungw haphungw merged commit 1d54810 into googleapis:main Mar 6, 2026
13 checks passed
haphungw added a commit to haphungw/librarian that referenced this pull request Mar 6, 2026
haphungw added a commit that referenced this pull request Mar 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

sidekick/rust: implement helper to generate resource name

2 participants