From b4bb145a06699c01a79d33bcae58fee450beada2 Mon Sep 17 00:00:00 2001
From: TaopaiC <124380+TaopaiC@users.noreply.github.com>
Date: Fri, 13 Sep 2024 22:18:50 +0800
Subject: [PATCH 1/2] Fix encoding issue in encode_path method

Fix `encode_path` whitelist to exclude '-' from encoding
---
 lib/vault/encode.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/vault/encode.rb b/lib/vault/encode.rb
index 59fb354b..438547e1 100644
--- a/lib/vault/encode.rb
+++ b/lib/vault/encode.rb
@@ -12,7 +12,7 @@ module EncodePath
     #
     # @return [String]
     def encode_path(path)
-      path.b.gsub(%r!([^a-zA-Z0-9_.-/]+)!) { |m|
+      path.b.gsub(%r!([^a-zA-Z0-9_.\-/]+)!) { |m|
         '%' + m.unpack('H2' * m.bytesize).join('%').upcase
       }
     end

From 7752a5bf844eff5b4c96c5662f9871da388cbdef Mon Sep 17 00:00:00 2001
From: Chris Arcand <chris@chrisarcand.com>
Date: Tue, 3 Feb 2026 15:11:51 -0600
Subject: [PATCH 2/2] Add tests for encode_path and update changelog

- Add unit tests for EncodePath#encode_path verifying correct
  handling of hyphens, spaces, and special characters
- Document the encode_path hyphen fix in CHANGELOG [GH-350, GH-343]
---
 CHANGELOG.md             |  5 +++
 spec/unit/encode_spec.rb | 67 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 spec/unit/encode_spec.rb

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d5caa04c..14f0e569 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 ## v?.??.? (Unreleased)
 
+BUG FIXES
+
+- Fixed `encode_path` incorrectly encoding hyphens (`-`), which caused 403 errors on Vault 1.15+ [GH-350, GH-343]
+- Fixed `FrozenError` when loading the gem with OpenSSL 4.0.0+ by removing modification of `OpenSSL::SSL::SSLContext::DEFAULT_PARAMS`. Modern Ruby (3.1+) already has secure SSL defaults. [GH-366, GH-381]
+
 ## v0.19.0 (December 3, 2025)
 
 BREAKING CHANGES
diff --git a/spec/unit/encode_spec.rb b/spec/unit/encode_spec.rb
new file mode 100644
index 00000000..4a8f9f51
--- /dev/null
+++ b/spec/unit/encode_spec.rb
@@ -0,0 +1,67 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+require "spec_helper"
+
+module Vault
+  describe EncodePath do
+    describe "#encode_path" do
+      it "does not encode alphanumeric characters" do
+        expect(EncodePath.encode_path("abcXYZ123")).to eq("abcXYZ123")
+      end
+
+      it "does not encode hyphens" do
+        expect(EncodePath.encode_path("lookup-self")).to eq("lookup-self")
+        expect(EncodePath.encode_path("auth/token/lookup-self")).to eq("auth/token/lookup-self")
+      end
+
+      it "does not encode underscores" do
+        expect(EncodePath.encode_path("my_secret")).to eq("my_secret")
+      end
+
+      it "does not encode periods" do
+        expect(EncodePath.encode_path("file.txt")).to eq("file.txt")
+      end
+
+      it "does not encode forward slashes" do
+        expect(EncodePath.encode_path("a/b/c")).to eq("a/b/c")
+      end
+
+      it "encodes spaces as %20" do
+        expect(EncodePath.encode_path("my secret")).to eq("my%20secret")
+      end
+
+      it "encodes special characters" do
+        expect(EncodePath.encode_path("test@example")).to eq("test%40example")
+        expect(EncodePath.encode_path("key=value")).to eq("key%3Dvalue")
+        expect(EncodePath.encode_path("a&b")).to eq("a%26b")
+      end
+
+      it "encodes colons" do
+        expect(EncodePath.encode_path("foo:bar")).to eq("foo%3Abar")
+      end
+
+      it "encodes tildes" do
+        expect(EncodePath.encode_path("test~value")).to eq("test%7Evalue")
+      end
+
+      it "encodes unicode characters" do
+        expect(EncodePath.encode_path("caf\u00e9")).to eq("caf%C3%A9")
+      end
+
+      it "handles empty strings" do
+        expect(EncodePath.encode_path("")).to eq("")
+      end
+
+      it "handles paths with multiple encoded segments" do
+        expect(EncodePath.encode_path("secret/my secret/sub path")).to eq("secret/my%20secret/sub%20path")
+      end
+
+      it "handles Vault auth paths correctly" do
+        expect(EncodePath.encode_path("auth/token/lookup-self")).to eq("auth/token/lookup-self")
+        expect(EncodePath.encode_path("auth/token/renew-self")).to eq("auth/token/renew-self")
+        expect(EncodePath.encode_path("sys/mounts/secret-store")).to eq("sys/mounts/secret-store")
+      end
+    end
+  end
+end