{"record":{"id":"dc0b7c87732de0d8","repo":"mem0ai/mem0","slug":"filter-value-for-key-r-contains-prohibited-chara","errorCode":null,"errorMessage":"Filter value for {key!r} contains prohibited characters (double quote or backslash): {value!r}","messagePattern":"Filter value for (.+?) contains prohibited characters \\(double quote or backslash\\): (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"mem0/vector_stores/upstash_vector.py","lineNumber":29,"sourceCode":"except ImportError:\n    raise ImportError(\"The 'upstash_vector' library is required. Please install it using 'pip install upstash_vector'.\")\n\n\nlogger = logging.getLogger(__name__)\n\n_SAFE_FILTER_KEY = re.compile(r\"[a-zA-Z_][a-zA-Z0-9_]*\\Z\")\n\n\ndef _validate_filter(key: str, value: Any) -> None:\n    if not isinstance(key, str) or not _SAFE_FILTER_KEY.fullmatch(key):\n        raise ValueError(f\"Invalid filter key: {key!r}\")\n    if not isinstance(value, (str, int, float, bool)):\n        raise ValueError(\n            f\"Filter value for {key!r} must be str, int, float, or bool, \"\n            f\"got {type(value).__name__}\"\n        )\n    if isinstance(value, str) and ('\"' in value or \"\\\\\" in value):\n        raise ValueError(\n            f\"Filter value for {key!r} contains prohibited characters \"\n            f\"(double quote or backslash): {value!r}\"\n        )\n\n\nclass OutputData(BaseModel):\n    id: Optional[str]  # memory id\n    score: Optional[float]  # is None for `get` method\n    payload: Optional[Dict]  # metadata\n\n\nclass UpstashVector(VectorStoreBase):\n    def __init__(\n        self,\n        collection_name: str,\n        url: Optional[str] = None,\n        token: Optional[str] = None,\n        client: Optional[Index] = None,","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/mem0/vector_stores/upstash_vector.py#L11-L47","documentation":"Raised by `_validate_filter` when a string filter value contains a double quote or a backslash. The Upstash filter is built by string interpolation, so these characters could terminate or alter the quoted literal — rejecting them is the injection defense. Values are otherwise passed through verbatim, so escaping is deliberately not attempted.","triggerScenarios":"Filtering on values containing `\"` (e.g. agent names like `assistant \"pro\"`), Windows-style paths with backslashes (`C:\\Users\\...`), or crafted input such as `u1\" OR 1=1 --` attempting filter injection.","commonSituations":"User-supplied free text (chat titles, agent names, tags) used directly as an equality filter value; LLM-generated filter values quoting terms; passing regexes or file paths as metadata filters.","solutions":["Sanitize at the boundary: strip or reject `\"` and `\\\\` in any value destined for an Upstash filter.","Better, filter on stable identifiers (IDs, slugs, hashes) instead of free-form text — store the text in the payload, match on the identifier.","If the character matters, encode it (e.g. percent-encoding or a hash of the value) consistently at write and read time."],"exampleFix":"# before\nname = 'assistant \"pro\"'\nmemory.search(\"q\", filters={\"agent_name\": name})  # ValueError\n\n# after\nimport hashlib\nslug = \"assistant-pro\"  # or hashlib.sha256(name.encode()).hexdigest()\nmemory.add(\"...\", metadata={\"agent_name\": name, \"agent_slug\": slug})\nmemory.search(\"q\", filters={\"agent_slug\": slug})","handlingStrategy":"validation","validationCode":"def safe_filter_value(value: str) -> str:\n    if '\\\"' in value or \"\\\\\" in value:\n        raise ValueError(\"Filter value contains double quote or backslash; filter on an identifier instead\")\n    return value","typeGuard":"def is_safe_filter_string(v) -> bool:\n    return isinstance(v, str) and '\\\"' not in v and \"\\\\\" not in v","tryCatchPattern":"try:\n    results = memory.search(\"q\", filters=filters)\nexcept ValueError as e:\n    if \"prohibited characters\" in str(e):\n        raise BadRequest(\"Filter values must not contain quotes or backslashes\") from e\n    raise","preventionTips":["Filter on stable identifiers (IDs, slugs, hashes), never free-form user text.","Reject quote/backslash characters at the API boundary — the library intentionally does not escape them.","When text matching is needed, move the check client-side over returned payloads."],"tags":["filters","upstash","validation","security","injection-prevention","vector-store"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}