Roger Barreto

Python: OpenApi: Harden operation path handling for consistent selection and request targeting (.Net & Python) (#14140) ## Motivation and Context The OpenAPI plugin imports operations from a spec and lets the host restrict which operations are exposed via an `OperationSelectionPredicate` (and via `OperationsToExclude`). Operation selection and request-URL construction should share one canonical interpretation of an operation path. This change closes two consistency gaps where a spec-supplied path could be interpreted differently at selection time than at request time. 1. **Selection vs. request path normalization.** The selection predicate received the raw operation path, while the request URL is built from a canonicalized path. An encoded dot-segment (for example `%2e%2e`) is textually different from the endpoint it canonicalizes to, so it could pass a path-based include/exclude filter yet resolve to a different route. Operations whose path contains an encoded or literal dot-segment are now excluded before the predicate is consulted, symmetric with the existing request-time dot-segment rejection. 2. **Request target reconciliation (defense in depth).** After the request URL is built, verify it did not move off the configured server. An operation path that is an absolute or authority-changing URI (for example `https://another-host/admin`) carries no dot-segment, so it passes path-segment validation, yet `System.Uri` / `urljoin` resolve it to a different scheme, host, or port. Such a request is now rejected before it is sent, so a credential-bearing request cannot be redirected to an unintended target. Both changes are applied symmetrically to the .NET and Python OpenAPI ports. ## Description - **.NET** - `OpenApiDocumentParser` skips operations whose path contains a dot-segment before invoking the selection predicate. - `RestApiOperation` extracts a shared `ContainsDotSegment` helper (reused by the existing `ValidatePathSegments`) and, after building the request URL, reconciles its scheme/host/port and base path against the configured server. - **Python** - `openapi_parser` skips dot-segment operations before the predicate runs. - `rest_api_operation` adds a shared `_contains_dot_segment` helper and a post-construction `_ensure_request_target_matches_server` reconciliation. ## Tests - .NET: added selection-exclusion and request-target reconciliation tests; full `Functions.UnitTests` OpenApi suite green (488). - Python: added parity tests for both behaviors; `tests/unit/connectors/openapi_plugin` green (173), ruff + ruff-format + mypy + pre-commit clean. ## Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] The PR follows the SK Contribution Guidelines - [x] All unit tests pass, and I have added new tests where possible

.Net: [BREAKING] Upgrade Prompty.Core to 2.0.0-beta.3 to resolve NU1903 vulnerability (#14169) ## Motivation and Context CI (`dotnet-build-and-test`) currently fails repo-wide on **NU1903**: `Prompty.Core` `0.2.3-beta` has a known high severity advisory [GHSA-wxhm-2mq7-7697](https://github.com/advisories/GHSA-wxhm-2mq7-7697) (path traversal in `${file:...}` reference expansion). The build treats the audit as an error (`--warnaserror`), so this blocks every .NET PR. The advisory is fixed in `Prompty.Core` **2.0.0-beta.2+**. That release is a significant rewrite: it targets **net9.0 only** and ships a new `.prompty` spec and API. There is no intermediate 0.x fix, so resolving the advisory requires this upgrade. ## Description Upgrades `Prompty.Core` `0.2.3-beta` → `2.0.0-beta.3` and adapts Semantic Kernel to the 2.0 surface. - **Package**: bump `Prompty.Core` in `Directory.Packages.props`; remove the `Scriban` workaround reference (2.0 no longer depends on it). - **Target frameworks**: retarget `Functions.Prompty` to `net10.0` only. The fixed package is net9.0-only, so `net8.0` and `netstandard2.0` can no longer be supported. - **Loader migration** (`KernelFunctionPrompty`): - Text input: `FrontmatterParser.Parse` + `Prompty.Load`. - File input: secure `PromptyLoader.Load` with `AllowedFileRoots` scoped to the prompty file's directory, so `${file:...}` references are confined (the fix for the advisory). - Parse failures are normalized to `ArgumentException` to preserve the input-validation contract. - **Test data + tests**: migrate the `.prompty` files to the 2.0 spec (`apiType`, list-form `inputs`, renamed `options`) and update `PromptyTests` accordingly. - **Samples**: update the `Concepts` inline templates to the 2.0 spec. ## ⚠️ Breaking changes `Microsoft.SemanticKernel.Prompty` is a preview (`-beta`) package. This change: - **Drops `net8.0` and `netstandard2.0`** support (now `net10.0` only). - Requires `.prompty` files to use the **2.0 spec** (`model.apiType`, `model.provider`, `connection.kind`, `inputs`/`outputs` as lists, renamed `model.options`). v1 files are not auto-migrated. See the [Prompty v1→v2 migration guide](https://www.prompty.ai/migration/). - No longer surfaces the following, which are not part of the 2.0 model: input/output `json_schema`, connection `service_id`, and arbitrary `model.options` passthrough beyond the strongly typed set. ## Validation - `Functions.Prompty.UnitTests`: **22/22 pass** (Release, `--warnaserror`). - `Functions.Prompty` and `Concepts` build clean, **no NU1903**. - `dotnet format --verify-no-changes` clean on changed projects. - Behavior coherence: rendered prompt output for the `Concepts` samples is **byte-for-byte identical** to the previously published package, and the samples were run end-to-end against a live model with the expected results. ## Contribution Checklist - [x] The code builds clean without errors or warnings - [x] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) - [x] All unit tests pass, and I have added/updated tests where possible - [x] I didn't break anyone 😄