Add tests for path traversal and invalid ID encoding methods

[Orkuncakilkaya]

No description provided.

[github-actions]

🟢 Coverage increased by 97.54%

Code Coverage Report

Coverage Report

St.	Category	Percentage	Covered / Total
🟢	Statements	97.54%	3615 / 3706
🟢	Functions	98.49%	1436 / 1458

Files Coverage

St.	File	Methods	Statements	Total Coverage

[Copilot]

🟡 Changes recommended

Host-injection tests use values without URL delimiters, so they do not exercise the claimed security behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds regression coverage for safe encoding of path parameters and invalid IDs.

Changes:

• Tests traversal and slash encoding.
• Verifies request hosts and paths for unusual or empty IDs.

File summaries

File	Description
test/ObjectSerializerTest.php	Tests path-value encoding edge cases.
test/Api/FingerprintApiTest.php	Tests encoded event and visitor request paths.

Review details

Suppressed comments (2)

test/Api/FingerprintApiTest.php:1574

• This fixture cannot affect the authority because it has no scheme or path delimiters, and it would produce the same assertions even with no path encoding. Use an absolute-URL-shaped ID and assert its encoded path so this security regression test can fail when encoding is removed.

        $request = $this->api->updateEventRequest('domain.tld', new EventUpdate());

        $this->assertSame('api.fpjs.io', $request->getUri()->getHost());
        $this->assertSame('/v4/events/domain.tld', $request->getUri()->getPath());

test/Api/FingerprintApiTest.php:1599

• This fixture cannot affect the authority because it has no scheme or path delimiters, and it would produce the same assertions even with no path encoding. Use an absolute-URL-shaped ID and assert its encoded path so this security regression test can fail when encoding is removed.

        $request = $this->api->deleteVisitorDataRequest('domain.tld');

        $this->assertSame('api.fpjs.io', $request->getUri()->getHost());
        $this->assertSame('/v4/visitors/domain.tld', $request->getUri()->getPath());

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🚀 Following releases will be created using changesets from this PR:

@fingerprint/php-sdk@7.6.1

Patch Changes

• Fixed event_id/visitor_id values of exactly . or .. being collapsed by curl's URL normalization before the request is sent, causing getEvent, updateEvent, and deleteVisitorData to hit the wrong endpoint instead of the requested resource. (7bab669)