{"record":{"id":"03a3464df477ed0e","repo":"Kuberwastaken/claurst","slug":"absolute-unix-paths-not-allowed","errorCode":null,"errorMessage":"Absolute Unix paths not allowed: {:?}","messagePattern":"Absolute Unix paths not allowed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src-rust/crates/core/src/team_memory_sync.rs","lineNumber":94,"sourceCode":"/// Checks performed (mirroring the TypeScript `securePath` validation):\n/// - No null bytes\n/// - No URL-encoded traversal sequences (`%2e`, `%2f`, case-insensitive)\n/// - No backslashes\n/// - Not an absolute path (Unix `/` or Windows `C:` style)\n/// - No `..` components\npub fn validate_memory_path(path: &str) -> Result<()> {\n    if path.contains('\\0') {\n        anyhow::bail!(\"Path contains null bytes: {:?}\", path);\n    }\n    let lower = path.to_ascii_lowercase();\n    if lower.contains(\"%2e\") || lower.contains(\"%2f\") {\n        anyhow::bail!(\"Path contains URL-encoded traversal sequences: {:?}\", path);\n    }\n    if path.contains('\\\\') {\n        anyhow::bail!(\"Path contains backslashes: {:?}\", path);\n    }\n    if path.starts_with('/') {\n        anyhow::bail!(\"Absolute Unix paths not allowed: {:?}\", path);\n    }\n    // Windows-style absolute path: e.g. \"C:\" or \"c:\"\n    if path.len() >= 2 {\n        let mut chars = path.chars();\n        let first = chars.next().unwrap();\n        if first.is_ascii_alphabetic() && chars.next() == Some(':') {\n            anyhow::bail!(\"Absolute Windows paths not allowed: {:?}\", path);\n        }\n    }\n    if path.split('/').any(|component| component == \"..\") {\n        anyhow::bail!(\"Path traversal not allowed: {:?}\", path);\n    }\n    Ok(())\n}\n\n// ---------------------------------------------------------------------------\n// TeamMemorySync\n// ---------------------------------------------------------------------------","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/core/src/team_memory_sync.rs#L76-L112","documentation":"Path-security guard in validate_memory_path: the sync key starts with '/', i.e. it is an absolute Unix path (formatted value shown). Absolute keys would resolve outside the team-memory directory, so only relative paths are accepted.","triggerScenarios":"Thrown at src-rust/crates/core/src/team_memory_sync.rs:94 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Strip the leading slash so the key is relative to the team-memory root","Re-create the entry under its correct relative location"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}