{"record":{"id":"0afe0f5406f1534f","repo":"TencentCloud/TencentDB-Agent-Memory","slug":"invalid-team-id-for-template-path-teamid","errorCode":null,"errorMessage":"invalid team_id for template path: ${teamId}","messagePattern":"invalid team_id for template path: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"MemoryPanel/src/panel/state/agent-template-store.ts","lineNumber":30,"sourceCode":"export interface AgentTemplateAssetIds {\n  skills?: string[];\n  code_graphs?: string[];\n  wikis?: string[];\n}\n\n/** 模板配置（= JSON 文件内容，对齐 agent/create 入参）。 */\nexport interface AgentTemplateConfig {\n  name: string;\n  description?: string | null;\n  prompt?: string | null;\n  visibility?: string;\n  metadata_json?: string;\n  asset_ids?: AgentTemplateAssetIds;\n}\n\nfunction templateFilePath(dir: string, instanceId: string, teamId: string): string {\n  if (/[/\\\\]|\\.\\./.test(teamId)) {\n    throw new Error(`invalid team_id for template path: ${teamId}`);\n  }\n  return path.join(dir, instanceId, teamId, 'template.json');\n}\n\nexport function saveAgentTemplate(\n  dir: string,\n  instanceId: string,\n  teamId: string,\n  config: AgentTemplateConfig,\n): void {\n  const filePath = templateFilePath(dir, instanceId, teamId);\n  mkdirSync(path.dirname(filePath), { recursive: true });\n  writeFileSync(filePath, JSON.stringify(config, null, 2), 'utf8');\n}\n\nexport function getAgentTemplate(\n  dir: string,\n  instanceId: string,","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/TencentCloud/TencentDB-Agent-Memory/blob/3efcd317b84146d6a08518ac0f7ee7c8a8d200ec/MemoryPanel/src/panel/state/agent-template-store.ts#L12-L48","documentation":"templateFilePath builds the on-disk path .../<instanceId>/<teamId>/template.json. Before joining it validates teamId with /[/\\\\]|\\.\\./ — any path separator or parent-directory sequence is rejected to prevent path traversal (e.g. '../../etc' or 'a/b') escaping the templates directory. The error is thrown before any file I/O occurs.","triggerScenarios":"Calling saveAgentTemplate / loadAgentTemplate (via filePath → templateFilePath) with a team_id containing '/' or '\\\\', or the literal '..' — typically an unsanitized user-supplied or externally-sourced team identifier.","commonSituations":"Importing team templates from untrusted JSON where team_id was never validated; legacy data with composite IDs like 'org/team'; users typing IDs with slashes in a UI.","solutions":["Sanitize/validate team_id upstream: reject or normalize any value containing path separators or '..'","Map composite identifiers to a safe slug (e.g. replace '/' and '\\\\' with '-') before calling the store","Surface a clear validation error to the user instead of this internal path error","Regenerate legacy team IDs to a safe charset ([A-Za-z0-9_-]) and migrate stored templates"],"exampleFix":"// before\nawait saveAgentTemplate(dir, instanceId, rawTeamId, template); // rawTeamId = 'org/team'\n// after\nconst safeTeamId = rawTeamId.replace(/[^A-Za-z0-9_-]/g, '-');\nawait saveAgentTemplate(dir, instanceId, safeTeamId, template);","handlingStrategy":"validation","validationCode":"function assertSafeTeamId(teamId: string): void {\n  if (!/^[A-Za-z0-9_-]+$/.test(teamId)) throw new Error(`unsafe team_id: ${teamId}`);\n}\nassertSafeTeamId(teamId); // call before saveAgentTemplate/loadAgentTemplate","typeGuard":"function isSafeTeamId(teamId: string): boolean {\n  return /^[A-Za-z0-9_-]+$/.test(teamId) && !teamId.includes('..');\n}","tryCatchPattern":"try {\n  return loadAgentTemplate(dir, instanceId, teamId);\n} catch (e) {\n  if (e instanceof Error && e.message.startsWith('invalid team_id')) {\n    throw new ValidationError(`team_id must not contain path separators or '..': ${teamId}`);\n  }\n  throw e;\n}","preventionTips":["Whitelist team_id charset ([A-Za-z0-9_-]) at every ingress point","Never pass raw external/user input as a filesystem path segment","Migrate legacy composite IDs (org/team) to slugs","Add unit tests covering traversal payloads ('..', 'a/b', 'a\\\\b')"],"tags":["validation","path-traversal","security"],"backgroundTag":"invalid-path-segment","analyzedSha":"3efcd317b84146d6a08518ac0f7ee7c8a8d200ec","analyzedAt":"2026-09-01T05:44:22.276Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}