fix(dms): prevent URL path injection in DMS client

[I559656]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

The DMS client was interpolating caller-supplied repository_id, repo_id, config_id, object_id, and path values directly into request URLs without any encoding or validation (CWE-88 / OWASP A03:2021 Injection). An application that forwards user input into these parameters could be used as a confused deputy — dot-segment traversal (../) or query-metacharacter injection (?, #) would redirect the authenticated request (carrying the app's OAuth token) to unintended DMS endpoints, including the Admin API.

Two module-level helpers are added to dms/client.py: _validate_id rejects any ID containing URL path metacharacters via an allowlist ([A-Za-z0-9_-]+, covering both UUID and MongoDB ObjectId formats); _safe_cmis_path splits CMIS browse paths on /, rejects ./.. segments, and percent-encodes each remaining segment. Both are applied at every URL construction site before string interpolation.

Related Issue

Closes #<issue_number>

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

1. Run the DMS unit tests: uv run pytest tests/dms/unit/test_client_admin.py tests/dms/unit/test_client_cmis.py -q — all 156 tests should pass including the 68 new injection regression tests.
2. Verify traversal is blocked: python -c "from sap_cloud_sdk.dms.client import DMSClient; DMSClient._browser_url('../../../rest/v2')" — should raise ValueError.
3. Verify clean paths still work: python -c "from sap_cloud_sdk.dms.client import DMSClient; print(DMSClient._browser_url('repo1', 'docs/q3'))" — should print /browser/repo1/root/docs/q3.
4. Verify CMIS path encoding: python -c "from sap_cloud_sdk.dms.client import DMSClient; print(DMSClient._browser_url('repo1', 'docs/file name.pdf'))" — should print /browser/repo1/root/docs/file%20name.pdf.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

[I559656]

this is for CWE-88 (Argument Injection) is dms url forming.

[NicoleMGomes]

review-pr was not called for this PR, since this is a small change I'm still accepting it. For next contributions, please check all PR checks and guidelines.

Thank you!