{"record":{"id":"6a158f025ec1e3b4","repo":"ruvnet/ruflo","slug":"invalid-session-id-path-traversal-detected","errorCode":null,"errorMessage":"Invalid session ID: path traversal detected","messagePattern":"Invalid session ID: path traversal detected","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/mcp/tools/session-tools.ts","lineNumber":232,"sourceCode":"  }\n  return true;\n}\n\n/**\n * Get session file path with security validation\n */\nfunction getSessionPath(sessionId: string): string {\n  if (!validateSessionId(sessionId)) {\n    throw new Error('Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores');\n  }\n  const sessionDir = path.join(process.cwd(), DEFAULT_SESSION_DIR);\n  const sessionPath = path.join(sessionDir, `${sessionId}.json`);\n\n  // Ensure the resolved path is within the session directory (defense in depth)\n  const resolvedPath = path.resolve(sessionPath);\n  const resolvedDir = path.resolve(sessionDir);\n  if (!resolvedPath.startsWith(resolvedDir + path.sep)) {\n    throw new Error('Invalid session ID: path traversal detected');\n  }\n\n  return sessionPath;\n}\n\n/**\n * Ensure session directory exists\n */\nasync function ensureSessionDir(): Promise<void> {\n  const dir = path.join(process.cwd(), DEFAULT_SESSION_DIR);\n  await fs.mkdir(dir, { recursive: true });\n}\n\n// ============================================================================\n// Tool Handlers\n// ============================================================================\n\n/**","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/mcp/tools/session-tools.ts#L214-L250","documentation":"Defense-in-depth check in getSessionPath: after building <sessionDir>/<sessionId>.json and resolving both, the resolved path does not sit inside the resolved session directory — the session id somehow escaped its slot (symlink or encoding trick). The write/read is refused rather than touching the outside path.","triggerScenarios":"Thrown at v3/mcp/tools/session-tools.ts:232 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove path separators and '..' from the session id.","Treat the session id as an opaque token, never as a path component from user input."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}