From 7663d06f83ac12fa3c02ed87fa68307faff26794 Mon Sep 17 00:00:00 2001 From: Michael Panchenko Date: Mon, 20 Apr 2026 10:58:10 +0200 Subject: [PATCH] Forbid ".." in memory names --- CHANGELOG.md | 1 + src/serena/project.py | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index df52a4dd..f236a554 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ Status of the `main` branch. Changes prior to the next official version change w - Fix: Check for ignored path ignored `.git` folder only at the top level, not in every subdirectory (`Project._is_ignored_relative_path`) #1350 - `GetSymbolsOverviewTool`: ignored paths were not respected in LSP variant (fix in `SolidLanguageServer`) - Fix: Duplicate comments in re-saved YAML configuration files #1285 + - Security: Forbid `".."` in memory names to disallow accessing files outside dedicated memory directories * JetBrains: - `Move` and `SafeDelete` tools: transform empty string to None (counteracts client errors) diff --git a/src/serena/project.py b/src/serena/project.py index 6f1cec43..c94d8b45 100644 --- a/src/serena/project.py +++ b/src/serena/project.py @@ -79,7 +79,10 @@ class MemoriesManager: def get_memory_file_path(self, name: str) -> Path: # Strip .md extension if present - name = name.replace(".md", "") + name = name.replace(".md", "").replace(os.sep, "/") + parts = name.split("/") + if ".." in parts: + raise ValueError(f"Memory name cannot contain '..' segments for security reasons. Got: {name}") if self._is_global(name): if name == self.GLOBAL_TOPIC: @@ -98,7 +101,7 @@ class MemoriesManager: # Project-local memory assert self._project_memory_dir is not None, "Project dir was not passed at initialization" - parts = name.split("/") + filename = f"{parts[-1]}.md" if len(parts) > 1: