Function validate_session_id

atomic-agent/src/turn/session.rs:620–649

Validate a session ID to prevent path traversal. Rejects IDs containing `..`, `/`, `\`, or null bytes.

(session_id: &str)

///
/// Rejects IDs containing `..`, `/`, `\`, or null bytes.
fn validate_session_id(session_id: &str) -> AgentResult<()> {
    if session_id.is_empty() {
        return Err(AgentError::SessionIdInvalid {
            session_id: "(empty)".to_string(),
        });
    }

    if session_id.contains("..")
        || session_id.contains('/')
        || session_id.contains('\\')
        || session_id.contains('\0')
    {
        return Err(AgentError::SessionIdInvalid {
            session_id: session_id.to_string(),
        });
    }

    // Reject very long session IDs (filesystem path limits)
    if session_id.len() > 255 {
        return Err(AgentError::SessionIdInvalid {
            session_id: format!(
                "{}... (too long: {} chars)",
                &session_id[..20],
                session_id.len()
            ),
        });
    }

    Ok(())
}

// Tests