Skip to content

fix: prevent path traversal in memory_read daily date#4

Merged
jayzeng merged 1 commit intomainfrom
fix/issue-3-memory-read-path-traversal
Apr 6, 2026
Merged

fix: prevent path traversal in memory_read daily date#4
jayzeng merged 1 commit intomainfrom
fix/issue-3-memory-read-path-traversal

Conversation

@jayzeng
Copy link
Copy Markdown
Owner

@jayzeng jayzeng commented Apr 6, 2026

Summary

  • validate memory_read daily date input with strict YYYY-MM-DD format + calendar checks
  • reject invalid dates early with a clear error response
  • harden dailyPath() to throw on invalid date input
  • add regression tests for invalid/traversal dates

Why

memory_read previously accepted arbitrary date strings, which could escape the daily directory when joined into a path.

Closes #3

Verification

  • npm test
  • npm run lint
  • npm run build
  • bun test test/unit.test.ts -t "memory_read tool|dailyPath"

Signed-off-by: Jay Zeng <jayzeng@users.noreply.github.com>
@jayzeng jayzeng merged commit 8dd2a26 into main Apr 6, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

memory_read can read file outside the memory directory

1 participant