fix(transfer_manager): Prevent path traversal in `download_many_to_path` by chandra-siri · Pull Request #1768

fix(transfer_manager): Prevent path traversal in `download_many_to_path` by chandra-siri · Pull Request #1768 · googleapis/python-storage

user provided destination_dir

bot added size: m

Pull request size is medium.

api: storage

Issues related to the googleapis/python-storage API.

labels

Mar 9, 2026

chandra-siri changed the title ~~fix: prevent downloading file in directory outside~~ fix(transfer_manager): Prevent path traversal in download_many_to_path

Mar 10, 2026

chandra-siri changed the title ~~fix(transfer_manager): Prevent path traversal in download_many_to_path~~ fix(transfer_manager): Prevent path traversal in download_many_to_path

Mar 10, 2026

chandra-siri added a commit that referenced this pull request

Mar 18, 2026

PR created by the Librarian CLI to initialize a release. Merging this PR
will auto trigger a release.

Librarian Version: v1.0.2-0.20251119154421-36c3e21ad3ac
Language Image:
us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:8e2c32496077054105bd06c54a59d6a6694287bc053588e24debe6da6920ad91
<details><summary>google-cloud-storage: 3.10.0</summary>

##
[3.10.0](v3.9.0...v3.10.0)
(2026-03-18)

### Features

* [Bucket Encryption Enforcement] add support for bucket encryption
enforcement config (#1742)
([2a6e8b0](2a6e8b0))

### Perf Improvments

* [Rapid Buckets Reads] Use raw proto access for read resumption
strategy (#1764)
([14cfd61](14cfd61))
* [Rapid Buckets Benchmarks] init mp pool & grpc client once, use
os.sched_setaffinity (#1751)
([a9eb82c](a9eb82c))
* [Rapid Buckets Writes] don't flush at every append, results in bad
perf (#1746)
([ab62d72](ab62d72))


### Bug Fixes

* [Windows] skip downloading blobs whose name contain `":" ` eg: `C:`
`D:` etc when application runs in Windows. (#1774)
([5581988](5581988))
* [Path Traversal] Prevent path traversal in `download_many_to_path`
(#1768)
([700fec3](700fec3))
* [Rapid Buckets] pass token correctly, '&' instead of ',' (#1756)
([d8dd1e0](d8dd1e0))


</details>