mlliuz 102bc5ef79 fix: prevent path traversal via session_id in session_store ...

load_session/save_session built the session file path directly from the
caller-supplied session_id with no validation, so a value like
'../../../tmp/secrets' (reachable from the 'load-session' CLI subcommand)
could read or write JSON files outside the session directory.

Add _validate_session_id() to reject anything outside [A-Za-z0-9_-]
(path separators, '..', absolute/Windows paths) before the id is used to
build a filename. Legitimate ids (uuid4 hex, 'session-<digits>-<n>') are
unaffected.

Adds SessionStorePathTraversalTests covering traversal rejection on both
load and save plus a legitimate-id round-trip.

2026-10-11 20:31:56 +00:00

..

__init__.py

test: cover roadmap helper missing path

2026-06-03 19:31:45 +09:00

test_porting_workspace.py

Improve command lookup normalization

2026-06-25 15:43:30 +08:00

test_pre_push_hook_contract.py

Prevent pre-push contract drift (#3113)

2026-05-26 06:00:45 +08:00

test_roadmap_helpers.py

test: cover roadmap helper missing path

2026-06-03 19:31:45 +09:00

test_security_scope.py

fix: prevent path traversal via session_id in session_store

2026-10-11 20:31:56 +00:00