ruvnet/ruflo · error · Error

Invalid session ID: path traversal detected

Error message

Invalid session ID: path traversal detected

What it means

Defense-in-depth check in getSessionPath: after building <sessionDir>/<sessionId>.json and resolving both, the resolved path does not sit inside the resolved session directory — the session id somehow escaped its slot (symlink or encoding trick). The write/read is refused rather than touching the outside path.

Source

Thrown at v3/mcp/tools/session-tools.ts:232

  }
  return true;
}

/**
 * Get session file path with security validation
 */
function getSessionPath(sessionId: string): string {
  if (!validateSessionId(sessionId)) {
    throw new Error('Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores');
  }
  const sessionDir = path.join(process.cwd(), DEFAULT_SESSION_DIR);
  const sessionPath = path.join(sessionDir, `${sessionId}.json`);

  // Ensure the resolved path is within the session directory (defense in depth)
  const resolvedPath = path.resolve(sessionPath);
  const resolvedDir = path.resolve(sessionDir);
  if (!resolvedPath.startsWith(resolvedDir + path.sep)) {
    throw new Error('Invalid session ID: path traversal detected');
  }

  return sessionPath;
}

/**
 * Ensure session directory exists
 */
async function ensureSessionDir(): Promise<void> {
  const dir = path.join(process.cwd(), DEFAULT_SESSION_DIR);
  await fs.mkdir(dir, { recursive: true });
}

// ============================================================================
// Tool Handlers
// ============================================================================

/**

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Remove path separators and '..' from the session id.
2. Treat the session id as an opaque token, never as a path component from user input.

When it happens

Trigger: Thrown at v3/mcp/tools/session-tools.ts:232 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/6a158f025ec1e3b4. Report an issue: GitHub.