Kuberwastaken/claurst · error

Path traversal not allowed

Error message

Path traversal not allowed: {:?}

What it means

Path-security guard in validate_memory_path: the final component check found a '..' segment in the sync key (formatted value shown), which would walk out of the team-memory directory. This is the classic traversal pattern; the entry is rejected outright.

Solutions

1. Remove '..' segments from the key; reference siblings directly instead
2. Drop the offending entry and re-create the file at its intended location
3. Audit where the key originated — traversal in a sync key suggests tampering

When it happens

Trigger: Thrown at src-rust/crates/core/src/team_memory_sync.rs:105 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kuberwastaken/claurst@b0637c97ec (2026-09-10). Data as JSON: /api/errors/f16e8e362cbeda5e. Report an issue: GitHub.

Appendix: source

Thrown at src-rust/crates/core/src/team_memory_sync.rs:105

    if lower.contains("%2e") || lower.contains("%2f") {
        anyhow::bail!("Path contains URL-encoded traversal sequences: {:?}", path);
    }
    if path.contains('\\') {
        anyhow::bail!("Path contains backslashes: {:?}", path);
    }
    if path.starts_with('/') {
        anyhow::bail!("Absolute Unix paths not allowed: {:?}", path);
    }
    // Windows-style absolute path: e.g. "C:" or "c:"
    if path.len() >= 2 {
        let mut chars = path.chars();
        let first = chars.next().unwrap();
        if first.is_ascii_alphabetic() && chars.next() == Some(':') {
            anyhow::bail!("Absolute Windows paths not allowed: {:?}", path);
        }
    }
    if path.split('/').any(|component| component == "..") {
        anyhow::bail!("Path traversal not allowed: {:?}", path);
    }
    Ok(())
}

// ---------------------------------------------------------------------------
// TeamMemorySync
// ---------------------------------------------------------------------------

/// Drives pull and push against the claude.ai team-memory API.
pub struct TeamMemorySync {
    /// Base URL of the API, e.g. `"https://claude.ai"`.
    api_base: String,
    /// Repo identifier sent as a query parameter.
    repo: String,
    /// Bearer token for authentication.
    token: String,
    /// Local directory that mirrors the server's key namespace.
    team_dir: PathBuf,

View on GitHub (pinned to b0637c97ec)