Fix double-slash URL path bug in 74 GetRequest methods (#650)

When optional path segments (Indices, Index, Repo, etc.) are empty,
path construction produced "//" which http.NewRequest misparses per
RFC 3986, treating the next segment as the URL authority. After the
transport overwrites the host, the path loses its API prefix,
causing requests to hit the wrong endpoint.

Extract opensearch.BuildPath helper that skips empty segments
(1 alloc, ~21ns — benchmarked against path.Join's 3 allocs, ~63ns).
Convert all 74 vulnerable GetRequest methods across opensearchapi,
plugins/security, and plugins/ism to use it.

Fixes: #617, #650

Signed-off-by: Sean Chittenden <sean.chittenden@crowdstrike.com>

Author: sean-

CHANGELOG.md

@@ -149,6 +149,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Extract `newMultiServerPoolFromClientWithLock` as single source of truth for Client-to-pool settings propagation ([#786](https://github.com/opensearch-project/opensearch-go/pull/786))
 - Skip shard routing integration tests on OpenSearch < 2.2.0 with security plugin due to server-side `OptionalDataException` from non-thread-safe User serialization (opensearch-project/security#1970)
 - Fix alias, mapping, settings, and block API URL path construction when Indices is empty, which caused `http.NewRequest` to misparse the double-slash as an authority separator ([#650](https://github.com/opensearch-project/opensearch-go/issues/650))
+- Fix URL path construction across 74 `GetRequest` methods where empty path segments produced a double-slash `//` that `http.NewRequest` misparsed as an RFC 3986 authority separator; extract `opensearch.BuildPath` helper to prevent the class of bug ([#617](https://github.com/opensearch-project/opensearch-go/issues/617), [#650](https://github.com/opensearch-project/opensearch-go/issues/650))
 - Fix discovery pool wipe when all cluster nodes time out during `/_nodes/http` fan-out: parse `_nodes` metadata envelope and return `errDiscoveryEmpty` when `successful == 0`, preserving the existing connection pool for retry ([#821](https://github.com/opensearch-project/opensearch-go/pull/821))
 - Fix flaky `TestDefaultHealthCheck_RetryAfterMaxRetry`: replace wall-clock `time.Sleep` + `atomic.Int64` synchronization with context cancellation (`ctx.Done()`), and widen `maxRetryClusterHealth` to 5s so the baseline HTTP round-trip cannot race past the retry interval ([#787](https://github.com/opensearch-project/opensearch-go/pull/787))
 - Fix connection lifecycle bug in multiServerPool.OnFailure where connections were scheduled for resurrection before being moved from ready to dead list, causing potential race conditions

opensearchapi/api_cat-snapshots.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -24,7 +23,7 @@ type CatSnapshotsReq struct {
 func (r CatSnapshotsReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"GET",
-		fmt.Sprintf("%s%s", "/_cat/snapshots/", r.Repository),
+		opensearch.BuildPath("_cat", "snapshots", r.Repository),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_cluster-decommission.go

@@ -8,7 +8,6 @@ package opensearchapi
 
 import (
 	"net/http"
-	"strings"
 
 	"github.com/opensearch-project/opensearch-go/v4"
 )
@@ -24,16 +23,9 @@ type ClusterPutDecommissionReq struct {
 
 // GetRequest returns the *http.Request that gets executed by the client
 func (r ClusterPutDecommissionReq) GetRequest() (*http.Request, error) {
-	var path strings.Builder
-	path.Grow(34 + len(r.AwarenessAttrName) + len(r.AwarenessAttrValue))
-	path.WriteString("/_cluster/decommission/awareness/")
-	path.WriteString(r.AwarenessAttrName)
-	path.WriteString("/")
-	path.WriteString(r.AwarenessAttrValue)
-
 	return opensearch.BuildRequest(
 		"PUT",
-		path.String(),
+		opensearch.BuildPath("_cluster", "decommission", "awareness", r.AwarenessAttrName, r.AwarenessAttrValue),
 		nil,
 		r.Params.get(),
 		r.Header,
@@ -89,15 +81,9 @@ type ClusterGetDecommissionReq struct {
 
 // GetRequest returns the *http.Request that gets executed by the client
 func (r ClusterGetDecommissionReq) GetRequest() (*http.Request, error) {
-	var path strings.Builder
-	path.Grow(41 + len(r.AwarenessAttrName))
-	path.WriteString("/_cluster/decommission/awareness/")
-	path.WriteString(r.AwarenessAttrName)
-	path.WriteString("/_status")
-
 	return opensearch.BuildRequest(
 		"GET",
-		path.String(),
+		opensearch.BuildPath("_cluster", "decommission", "awareness", r.AwarenessAttrName, "_status"),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_component_template-create.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"io"
 	"net/http"
 
@@ -28,7 +27,7 @@ type ComponentTemplateCreateReq struct {
 func (r ComponentTemplateCreateReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"PUT",
-		fmt.Sprintf("/_component_template/%s", r.ComponentTemplate),
+		opensearch.BuildPath("_component_template", r.ComponentTemplate),
 		r.Body,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_component_template-delete.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -25,7 +24,7 @@ type ComponentTemplateDeleteReq struct {
 func (r ComponentTemplateDeleteReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"DELETE",
-		fmt.Sprintf("/_component_template/%s", r.ComponentTemplate),
+		opensearch.BuildPath("_component_template", r.ComponentTemplate),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_component_template-exists.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -25,7 +24,7 @@ type ComponentTemplateExistsReq struct {
 func (r ComponentTemplateExistsReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"HEAD",
-		fmt.Sprintf("/_component_template/%s", r.ComponentTemplate),
+		opensearch.BuildPath("_component_template", r.ComponentTemplate),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_dangling-delete.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -25,7 +24,7 @@ type DanglingDeleteReq struct {
 func (r DanglingDeleteReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"DELETE",
-		fmt.Sprintf("/_dangling/%s", r.IndexUUID),
+		opensearch.BuildPath("_dangling", r.IndexUUID),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_dangling-import.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -25,7 +24,7 @@ type DanglingImportReq struct {
 func (r DanglingImportReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"POST",
-		fmt.Sprintf("/_dangling/%s", r.IndexUUID),
+		opensearch.BuildPath("_dangling", r.IndexUUID),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_datastream-create.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -25,7 +24,7 @@ type DataStreamCreateReq struct {
 func (r DataStreamCreateReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"PUT",
-		fmt.Sprintf("/_data_stream/%s", r.DataStream),
+		opensearch.BuildPath("_data_stream", r.DataStream),
 		nil,
 		r.Params.get(),
 		r.Header,

opensearchapi/api_datastream-delete.go

@@ -7,7 +7,6 @@
 package opensearchapi
 
 import (
-	"fmt"
 	"net/http"
 
 	"github.com/opensearch-project/opensearch-go/v4"
@@ -25,7 +24,7 @@ type DataStreamDeleteReq struct {
 func (r DataStreamDeleteReq) GetRequest() (*http.Request, error) {
 	return opensearch.BuildRequest(
 		"DELETE",
-		fmt.Sprintf("/_data_stream/%s", r.DataStream),
+		opensearch.BuildPath("_data_stream", r.DataStream),
 		nil,
 		r.Params.get(),
 		r.Header,