{"record":{"id":"5f0dddc059fb92bb","repo":"ruvnet/ruflo","slug":"invalid-session-id-must-contain-only-alphanumeric","errorCode":null,"errorMessage":"Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores","messagePattern":"Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/mcp/tools/session-tools.ts","lineNumber":223,"sourceCode":"    return false;\n  }\n  // Additional checks for path traversal patterns\n  if (sessionId.includes('..') || sessionId.includes('/') || sessionId.includes('\\\\')) {\n    return false;\n  }\n  // Limit length to prevent excessive file names\n  if (sessionId.length > 128) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Get session file path with security validation\n */\nfunction getSessionPath(sessionId: string): string {\n  if (!validateSessionId(sessionId)) {\n    throw new Error('Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores');\n  }\n  const sessionDir = path.join(process.cwd(), DEFAULT_SESSION_DIR);\n  const sessionPath = path.join(sessionDir, `${sessionId}.json`);\n\n  // Ensure the resolved path is within the session directory (defense in depth)\n  const resolvedPath = path.resolve(sessionPath);\n  const resolvedDir = path.resolve(sessionDir);\n  if (!resolvedPath.startsWith(resolvedDir + path.sep)) {\n    throw new Error('Invalid session ID: path traversal detected');\n  }\n\n  return sessionPath;\n}\n\n/**\n * Ensure session directory exists\n */\nasync function ensureSessionDir(): Promise<void> {","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/mcp/tools/session-tools.ts#L205-L241","documentation":"getSessionPath's validateSessionId failed: the session id contains characters outside [A-Za-z0-9_-], is longer than 128 chars, or embeds traversal patterns (.., /, \\). The id is used to build a filename under the session directory, so any suspect input is rejected before path construction.","triggerScenarios":"Thrown at v3/mcp/tools/session-tools.ts:223 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use only alphanumeric characters, hyphens, and underscores in the session id.","Generate session ids with a safe generator (e.g. UUID without braces)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}