@mulmobridge/chat-service 0.1.6 → 0.1.7

package/dist/chat-state.d.ts

@@ -22,6 +22,15 @@ export interface ChatStateStore {
     connectSession(transportId: string, externalChatId: string, chatSessionId: string, roleId?: string): Promise<TransportChatState | null>;
     generateSessionId(transportId: string, externalChatId: string): string;
 }
+/** True iff `sessionId` is safe to persist into transport state and later
+ *  hand to session-metadata / event-log readers on the host side. Adds an
+ *  explicit `..` rejection on top of `isSafeId` — the safe-id character
+ *  class alone would accept the literal `..` and let a state file written
+ *  by `/connect` poison downstream commands (e.g. `/history` reading the
+ *  poisoned sessionId back through `readSessionJsonl`). Applied at the
+ *  `/connect` route entry AND inside `connectSession` as defense-in-depth
+ *  (issue #1896 follow-up to #1888 / #1895). */
+export declare function isSafeSessionId(sessionId: string): boolean;
 export declare function createChatStateStore(opts: {
     transportsDir: string;
     logger: Logger;

package/dist/chat-state.js

@@ -15,6 +15,23 @@ import { writeFileAtomic } from "./atomic-write.js";
 function isSafeId(id) {
     return /^[\w.-]+$/.test(id) && id.length > 0 && id.length <= 200;
 }
+/** True iff `sessionId` is safe to persist into transport state and later
+ *  hand to session-metadata / event-log readers on the host side. Adds an
+ *  explicit `..` rejection on top of `isSafeId` — the safe-id character
+ *  class alone would accept the literal `..` and let a state file written
+ *  by `/connect` poison downstream commands (e.g. `/history` reading the
+ *  poisoned sessionId back through `readSessionJsonl`). Applied at the
+ *  `/connect` route entry AND inside `connectSession` as defense-in-depth
+ *  (issue #1896 follow-up to #1888 / #1895). */
+export function isSafeSessionId(sessionId) {
+    if (typeof sessionId !== "string")
+        return false;
+    if (!isSafeId(sessionId))
+        return false;
+    if (sessionId.includes(".."))
+        return false;
+    return true;
+}
 // ── Factory ──────────────────────────────────────────────────
 export function createChatStateStore(opts) {
     const { transportsDir, logger } = opts;
@@ -58,6 +75,18 @@ export function createChatStateStore(opts) {
         return state;
     };
     const connectSession = async (transportId, externalChatId, chatSessionId, roleId) => {
+        // Defense-in-depth: even though the /connect route validates chatSessionId
+        // at entry, refuse to persist an unsafe value here too. Otherwise a caller
+        // that bypasses the route (test harness, alternate transport, direct store
+        // access) could still write a hostile sessionId into the state file — and
+        // downstream commands like /history would later read that back into
+        // path-traversing filesystem operations. Return null so the route surfaces
+        // it as 404 (same as "no state for this chat"); either way the caller
+        // can't succeed with a hostile input. Issue #1896.
+        if (!isSafeSessionId(chatSessionId)) {
+            logger.warn("chat-state", "refused to connect unsafe sessionId", { transportId, externalChatId });
+            return null;
+        }
         const existing = await getChatState(transportId, externalChatId);
         if (!existing)
             return null;

package/dist/index.js

@@ -17,7 +17,7 @@
 // standalone npm package without internal edits. See #269 / #305.
 import { Router } from "express";
 import { CHAT_SERVICE_ROUTES } from "@mulmobridge/protocol";
-import { createChatStateStore } from "./chat-state.js";
+import { createChatStateStore, isSafeSessionId } from "./chat-state.js";
 import { createCommandHandler } from "./commands.js";
 import { createRelay } from "./relay.js";
 import { createPushQueue } from "./push-queue.js";
@@ -97,6 +97,17 @@ export function createChatService(deps) {
             badRequest(res, "chatSessionId is required");
             return;
         }
+        // Reject hostile / malformed sessionIds at the entry so they can't be
+        // persisted into transport state. Without this gate a caller could POST
+        // `{"chatSessionId": "../../etc/x"}`, the value would land in the state
+        // file, and a later `/history` command would read it back and hand it to
+        // `readSessionJsonl` — whose backing reader is documented as "internal
+        // fixed paths only, no `..` traversal guard". Also defended inside
+        // `connectSession` for defense-in-depth (issue #1896 follow-up to #1895).
+        if (!isSafeSessionId(chatSessionId)) {
+            badRequest(res, "chatSessionId has an unsafe format");
+            return;
+        }
         // Resolve the target session's role BEFORE calling connectSession so the
         // persisted state's `roleId` tracks the new session's role — otherwise the
         // next relay's `startChat` would resume the new session under the previous

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmobridge/chat-service",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Server-side chat service for MulmoBridge — socket.io + REST bridge to Claude Code agents",
   "type": "module",
   "main": "./dist/index.js",