{"record":{"id":"75f7360d45190837","repo":"Kuberwastaken/claurst","slug":"path-contains-url-encoded-traversal-sequences","errorCode":null,"errorMessage":"Path contains URL-encoded traversal sequences: {:?}","messagePattern":"Path contains URL-encoded traversal sequences: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src-rust/crates/core/src/team_memory_sync.rs","lineNumber":88,"sourceCode":"// ---------------------------------------------------------------------------\n// Path security validation\n// ---------------------------------------------------------------------------\n\n/// Reject paths that could escape the team-memory directory.\n///\n/// Checks performed (mirroring the TypeScript `securePath` validation):\n/// - No null bytes\n/// - No URL-encoded traversal sequences (`%2e`, `%2f`, case-insensitive)\n/// - No backslashes\n/// - Not an absolute path (Unix `/` or Windows `C:` style)\n/// - No `..` components\npub fn validate_memory_path(path: &str) -> Result<()> {\n    if path.contains('\\0') {\n        anyhow::bail!(\"Path contains null bytes: {:?}\", path);\n    }\n    let lower = path.to_ascii_lowercase();\n    if lower.contains(\"%2e\") || lower.contains(\"%2f\") {\n        anyhow::bail!(\"Path contains URL-encoded traversal sequences: {:?}\", path);\n    }\n    if path.contains('\\\\') {\n        anyhow::bail!(\"Path contains backslashes: {:?}\", path);\n    }\n    if path.starts_with('/') {\n        anyhow::bail!(\"Absolute Unix paths not allowed: {:?}\", path);\n    }\n    // Windows-style absolute path: e.g. \"C:\" or \"c:\"\n    if path.len() >= 2 {\n        let mut chars = path.chars();\n        let first = chars.next().unwrap();\n        if first.is_ascii_alphabetic() && chars.next() == Some(':') {\n            anyhow::bail!(\"Absolute Windows paths not allowed: {:?}\", path);\n        }\n    }\n    if path.split('/').any(|component| component == \"..\") {\n        anyhow::bail!(\"Path traversal not allowed: {:?}\", path);\n    }","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/core/src/team_memory_sync.rs#L70-L106","documentation":"Path-security guard in validate_memory_path: the path (case-insensitively) contains %2e or %2f — percent-encoded '.' or '/' sequences used to smuggle traversal past naive decoding. The formatted value is the offending input; the check runs before any decoding so encoded traversal cannot escape the memory directory.","triggerScenarios":"Thrown at src-rust/crates/core/src/team_memory_sync.rs:88 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rename the file so its key contains no percent-encoded dot/slash sequences","Reject the entry — encoded traversal in a sync key is hostile or corrupted input","Sanitize team-memory keys on ingest before they reach sync"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}