MemPalace/mempalace · error · ValueError

{field_name} contains invalid path characters

Error message

{field_name} contains invalid path characters

What it means

Raised by sanitize_name() when the name contains '..', '/', or '\\'. Wing and room names map onto filesystem directory names and collection ids, so path separators or traversal sequences could escape the palace directory or corrupt the layout; they are rejected outright rather than escaped.

Source

Thrown at mempalace/config.py:88

    return name.lower().replace(" ", "_").replace("-", "_").strip("_")


def sanitize_name(value: str, field_name: str = "name") -> str:
    """Validate and sanitize a wing/room/entity name.

    Raises ValueError if the name is invalid.
    """
    if not isinstance(value, str) or not value.strip():
        raise ValueError(f"{field_name} must be a non-empty string")

    value = value.strip()

    if len(value) > MAX_NAME_LENGTH:
        raise ValueError(f"{field_name} exceeds maximum length of {MAX_NAME_LENGTH} characters")

    # Block path traversal
    if ".." in value or "/" in value or "\\" in value:
        raise ValueError(f"{field_name} contains invalid path characters")

    # Block null bytes
    if "\x00" in value:
        raise ValueError(f"{field_name} contains null bytes")

    # Enforce safe character set
    if not _SAFE_NAME_RE.match(value):
        raise ValueError(f"{field_name} contains invalid characters")

    return value


def sanitize_kg_value(value: str, field_name: str = "value") -> str:
    """Validate a knowledge-graph entity name (subject or object).

    More permissive than sanitize_name — allows punctuation like commas,
    colons, and parentheses that are common in natural-language KG values.
    Only blocks null bytes and over-length strings.

View on GitHub (pinned to 06cb6987f0)

Solutions

  1. Pass only the final path segment: use Path(p).name or os.path.basename(p) to derive the name
  2. Replace separators with underscores if the hierarchical look matters: name.replace("/", "_")
  3. Never construct storage paths yourself — pass bare names and let the library build paths

Example fix

# before
create_room("projects/mempalace/2026-08-14")

# after
create_room("projects_mempalace_2026-08-14")
Defensive patterns

Strategy: validation

Validate before calling

# Derive names from paths safely before any call:
from pathlib import Path
name = Path(user_path).name          # final segment only
if ".." in name:
    raise SystemExit("invalid name")

Type guard

def is_path_safe_name(value: str) -> bool:
    return isinstance(value, str) and not any(t in value for t in ("..", "/", "\\")) and bool(value.strip())

Try / catch

try:
    safe = sanitize_name(name)
except ValueError as exc:
    if "invalid path characters" in str(exc):
        safe = sanitize_name(name.replace("/", "_").replace("\\", "_"))
    else:
        raise

Prevention

When it happens

Trigger: Passing a name like "../palace_backup", "docs/notes", "C:\\wings", or any string containing a slash, backslash, or '..' — commonly from user-typed paths or file-derived names passed unmodified.

Common situations: Users supplying a relative path instead of a bare name; deriving names from file paths without taking only the basename; Windows-style names with backslashes; LLM tool calls echoing a path the user mentioned.

Related errors

AI-assisted analysis of MemPalace/mempalace@06cb6987f0 (2026-08-15). Data as JSON: /api/errors/a716136f68999f24. Report an issue: GitHub.