{"record":{"id":"f16e8e362cbeda5e","repo":"Kuberwastaken/claurst","slug":"path-traversal-not-allowed","errorCode":null,"errorMessage":"Path traversal not allowed: {:?}","messagePattern":"Path traversal not allowed: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src-rust/crates/core/src/team_memory_sync.rs","lineNumber":105,"sourceCode":"    if lower.contains(\"%2e\") || lower.contains(\"%2f\") {\n        anyhow::bail!(\"Path contains URL-encoded traversal sequences: {:?}\", path);\n    }\n    if path.contains('\\\\') {\n        anyhow::bail!(\"Path contains backslashes: {:?}\", path);\n    }\n    if path.starts_with('/') {\n        anyhow::bail!(\"Absolute Unix paths not allowed: {:?}\", path);\n    }\n    // Windows-style absolute path: e.g. \"C:\" or \"c:\"\n    if path.len() >= 2 {\n        let mut chars = path.chars();\n        let first = chars.next().unwrap();\n        if first.is_ascii_alphabetic() && chars.next() == Some(':') {\n            anyhow::bail!(\"Absolute Windows paths not allowed: {:?}\", path);\n        }\n    }\n    if path.split('/').any(|component| component == \"..\") {\n        anyhow::bail!(\"Path traversal not allowed: {:?}\", path);\n    }\n    Ok(())\n}\n\n// ---------------------------------------------------------------------------\n// TeamMemorySync\n// ---------------------------------------------------------------------------\n\n/// Drives pull and push against the claude.ai team-memory API.\npub struct TeamMemorySync {\n    /// Base URL of the API, e.g. `\"https://claude.ai\"`.\n    api_base: String,\n    /// Repo identifier sent as a query parameter.\n    repo: String,\n    /// Bearer token for authentication.\n    token: String,\n    /// Local directory that mirrors the server's key namespace.\n    team_dir: PathBuf,","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/core/src/team_memory_sync.rs#L87-L123","documentation":"Path-security guard in validate_memory_path: the final component check found a '..' segment in the sync key (formatted value shown), which would walk out of the team-memory directory. This is the classic traversal pattern; the entry is rejected outright.","triggerScenarios":"Thrown at src-rust/crates/core/src/team_memory_sync.rs:105 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove '..' segments from the key; reference siblings directly instead","Drop the offending entry and re-create the file at its intended location","Audit where the key originated — traversal in a sync key suggests tampering"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}