fix(cli): sanitize test_name on GET, DELETE, and rebuild

[Oskii]

Fixes #7033

What

adk web can create, read, delete, and rebuild agent test JSON files under <agent>/tests/. create_test already ran os.path.basename on test_name so a name cannot leave that folder. GET, DELETE, and rebuild did not.

On main @ b018062, this DELETE removes a file next to tests/, not inside it:

DELETE /dev/apps/<app>/tests/%2e%2e%2foutside.json

The path param decodes to ../outside.json. os.path.join(tests_dir, test_name) follows it. GET reads the same way. POST .../tests/rebuild?test_name=../outside.json passes that path into rebuild_tests.

This is the local unauthenticated dev server. Default bind is loopback. It still matters if someone uses --host 0.0.0.0, or if anything else can hit those routes.

After the fix, those names are stripped to outside.json and resolved only under tests/. A missing file is 404. The file outside tests/ is left alone.

Why

I was reading the test-file routes next to test_create_test. The create handler has an explicit comment about directory traversal. I tried the same name on DELETE with a percent-encoded ../ and the file outside tests/ was gone.

How

One helper, _sanitize_test_filename, used by create, get, delete, and rebuild. Same basename plus the existing .json suffix rule. No new public API.

Testing

Added test_get_test_rejects_path_traversal, test_delete_test_rejects_path_traversal, and test_rebuild_single_test_rejects_path_traversal. Existing create/get/delete/rebuild cases still pass.

pytest tests/unittests/cli/test_adk_web_server_tests.py::test_get_test_rejects_path_traversal tests/unittests/cli/test_adk_web_server_tests.py::test_delete_test_rejects_path_traversal tests/unittests/cli/test_adk_web_server_tests.py::test_rebuild_single_test_rejects_path_traversal tests/unittests/cli/test_adk_web_server_tests.py::test_delete_test tests/unittests/cli/test_adk_web_server_tests.py::test_get_test_content tests/unittests/cli/test_adk_web_server_tests.py::test_create_test tests/unittests/cli/test_adk_web_server_tests.py::test_rebuild_single_test -q

7 passed.

Testing plan

• Unit tests above (TestClient, no live adk web).
• Dedicated GET traversal case added after review feedback on adk web GET/DELETE test endpoints skip the create_test path sanitiser #7033.
• I did not run the full tox matrix on this machine.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Oskii]

I added the required CLA from this github account :)

[Oskii]

Follow-up: dedicated GET traversal test is in test_get_test_rejects_path_traversal, matching DELETE. CLA on this account was signed; if cla/google is still red a re-check from the CLA bot would help.

[Oskii]

Rewrote the follow-up commit so cla/google is no longer blocked by an extra Co-authored-by the CLA bot could not cover. Same tree: dedicated test_get_test_rejects_path_traversal as requested on #7033.

cla/google, check-changes, and header-check are green. Continuous Integration is waiting on first-time contributor workflow approval: https://github.com/google/adk-python/actions/runs/34226805059

@surajksharma07 you already confirmed the helper locally; this is ready for review once CI is allowed to run.