fix(destination): add missing validate_resource_name to get_instance/subaccount read methods

get_instance_fragment, get_subaccount_fragment, get_instance_certificate, and
get_subaccount_certificate were delegating directly to internal helpers that have an
except Exception catch-all, causing invalid names to raise DestinationOperationError
instead of ValueError. Add validate_resource_name before the try block in all four
methods, consistent with every other public method on this branch.

Also replace path-echo in _http.py traversal guard error message with a fixed generic
message to avoid returning attacker-controlled strings in error responses.

843 tests green.

Author: tiagoek

src/sap_cloud_sdk/destination/_http.py

@@ -36,9 +36,7 @@ def _request(
     # even if the client-layer validation is somehow bypassed.
     path_segments = normalized_path.split("/")
     if ".." in path_segments:
-        raise HttpError(
-            f"Path traversal detected: '..' segment in path {normalized_path!r}",
-        )
+        raise HttpError("Forbidden: path traversal detected")
     try:
         resp = http.request(
             method,

src/sap_cloud_sdk/destination/certificate_client.py

@@ -173,6 +173,7 @@ def get_instance_certificate(self, name: str) -> Optional[Certificate]:
         Raises:
             DestinationOperationError: If an HTTP error occurs or response parsing fails.
         """
+        validate_resource_name(name)
         try:
             return self._get_certificate(name=name, level=Level.SERVICE_INSTANCE)
         except HttpError as e:
@@ -207,6 +208,7 @@ def get_subaccount_certificate(
             DestinationOperationError: If tenant is missing for subscriber access strategies,
                                        on HTTP errors, or response parsing failures.
         """
+        validate_resource_name(name)
         try:
             return self._apply_access_strategy(
                 access_strategy=access_strategy,

src/sap_cloud_sdk/destination/fragment_client.py

@@ -94,6 +94,7 @@ def get_instance_fragment(self, name: str) -> Optional[Fragment]:
         Raises:
             DestinationOperationError: If an HTTP error occurs or response parsing fails.
         """
+        validate_resource_name(name)
         try:
             return self._get_fragment(name=name, level=Level.SERVICE_INSTANCE)
         except HttpError as e:
@@ -126,6 +127,7 @@ def get_subaccount_fragment(
             DestinationOperationError: If tenant is missing for subscriber access strategies,
                                        on HTTP errors, or response parsing failures.
         """
+        validate_resource_name(name)
         try:
             return self._apply_access_strategy(
                 access_strategy=access_strategy,

tests/destination/unit/test_certificate_client.py

@@ -634,3 +634,17 @@ def test_update_certificate_rejects_invalid_name(self, client):
         with pytest.raises(ValueError):
             c.update_certificate(cert)
         http.request.assert_not_called()
+
+    @pytest.mark.parametrize("name", _ATTACK_NAMES)
+    def test_get_instance_certificate_rejects_traversal_names(self, client, name):
+        c, http = client
+        with pytest.raises(ValueError):
+            c.get_instance_certificate(name)
+        http.request.assert_not_called()
+
+    @pytest.mark.parametrize("name", _ATTACK_NAMES)
+    def test_get_subaccount_certificate_rejects_traversal_names(self, client, name):
+        c, http = client
+        with pytest.raises(ValueError):
+            c.get_subaccount_certificate(name)
+        http.request.assert_not_called()

tests/destination/unit/test_fragment_client.py

@@ -606,3 +606,17 @@ def test_update_fragment_rejects_invalid_name(self, client):
         with pytest.raises(ValueError):
             c.update_fragment(frag)
         http.request.assert_not_called()
+
+    @pytest.mark.parametrize("name", _ATTACK_NAMES)
+    def test_get_instance_fragment_rejects_traversal_names(self, client, name):
+        c, http = client
+        with pytest.raises(ValueError):
+            c.get_instance_fragment(name)
+        http.request.assert_not_called()
+
+    @pytest.mark.parametrize("name", _ATTACK_NAMES)
+    def test_get_subaccount_fragment_rejects_traversal_names(self, client, name):
+        c, http = client
+        with pytest.raises(ValueError):
+            c.get_subaccount_fragment(name)
+        http.request.assert_not_called()