{"record":{"id":"e84bd8428a485ee6","repo":"Yeachan-Heo/oh-my-codex","slug":"filename-must-not-contain","errorCode":null,"errorMessage":"fileName must not contain \"..\"","messagePattern":"fileName must not contain \"\\.\\.\"","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/mcp/state-paths.ts","lineNumber":163,"sourceCode":"    throw new Error('mode must match ^[A-Za-z0-9_-]{1,64}$');\n  }\n  return normalized;\n}\n\nexport function getStateFilename(mode: string): string {\n  return `${validateStateModeSegment(mode)}${STATE_FILE_SUFFIX}`;\n}\n\nexport function validateStateFileName(fileName: unknown): string {\n  if (typeof fileName !== 'string') {\n    throw new Error('fileName must be a string');\n  }\n  const normalized = fileName.trim();\n  if (!normalized) {\n    throw new Error('fileName must be a non-empty string');\n  }\n  if (normalized.includes('..')) {\n    throw new Error('fileName must not contain \"..\"');\n  }\n  if (normalized.includes('/') || normalized.includes('\\\\')) {\n    throw new Error('fileName must not contain path separators');\n  }\n  if (!STATE_FILE_NAME_PATTERN.test(normalized)) {\n    throw new Error('fileName must match ^[A-Za-z0-9._-]{1,128}$');\n  }\n  return normalized;\n}\n\nfunction convertWindowsToWslPath(raw: string): string {\n  const m = /^([a-zA-Z]):[\\\\/](.*)$/.exec(raw);\n  if (!m) return raw;\n  const drive = m[1].toLowerCase();\n  const rest = String(m[2] || '').replace(/\\\\/g, '/');\n  const mountRoot = `/mnt/${drive}`;\n  if (!existsSync(mountRoot)) return raw;\n  return rest ? `${mountRoot}/${rest}` : mountRoot;","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/mcp/state-paths.ts#L145-L181","documentation":"Thrown when the trimmed fileName contains \"..\". Filenames are joined into state directory paths, so double dots could traverse out of the state directory — they are explicitly rejected before the pattern check.","triggerScenarios":"fileName: \"..json\", fileName: \"a..b.json\", or fileName: \"..\" attempting traversal.","commonSituations":"Attempting to point at files outside the state directory; double-dot typos in generated names; adversarial input probing path handling.","solutions":["Remove '..' sequences from generated filenames","Use only the pattern-legal set: letters, digits, dot, underscore, hyphen (single dots are fine, e.g. \"state.json\")","Sanitize untrusted names: name.replace(/\\.\\./g, \"\")"],"exampleFix":"// before\ngetStateFilePath(\"../secret.json\");\n// after\ngetStateFilePath(\"secret.json\");","handlingStrategy":"validation","validationCode":"fileName = fileName.replace(/\\.\\./g, '');","typeGuard":"function hasNoDotDot(v: string): boolean { return !v.includes('..'); }","tryCatchPattern":null,"preventionTips":["Take only basenames from user paths","Strip '..' from generated names"],"tags":["path-traversal","security","state","mcp"],"backgroundTag":"path-traversal-blocked","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}