anthropics / anthropics/claude-agent-sdk-python
list_sessions_from_store exposes invalid session IDs returned by adapters
- 主要言語
- Python
- スター
- 8.1k
- フォーク
- 1.3k
- 平均マージ
- 2日 31分
- マージ済み PR(30日)
- 1
説明
### Summary
Store-backed session listing does not validate session IDs, unlike filesystem listing and individual store-backed lookup.
### Affected code
- `src/claude_agent_sdk/_internal/sessions.py:1525-1575`
- `src/claude_agent_sdk/_internal/sessions.py:1637-1685`
- `src/claude_agent_sdk/_internal/sessions.py:1723-1732`
- `src/claude_agent_sdk/_internal/session_summary.py:219-222`
### Current behavior
The slow path passes every `session_id` returned by `SessionStore.list_sessions()` into loads and then into `SDKSessionInfo`. The fast path similarly copies IDs from session summaries or listings into slots without `_validate_uuid()`.
By contrast:
- filesystem listing skips filenames that are not UUIDs;
- `get_session_info_from_store()` returns `None` for an invalid UUID;
- mutation helpers reject invalid IDs.
### Why this matters
A malformed, stale, or externally populated backend row becomes a public `SDKSessionInfo` and consumes an offset/limit position. The SDK can therefore return session IDs that its own get, resume, fork, and mutation APIs reject.
It also causes inconsistent behavior between otherwise equivalent disk, slow-store, and summary-fast listing paths.
### Expected behavior
All public session listing implementations should filter invalid session IDs before loading, sorting, or pagination.
### Possible fix
Validate IDs as soon as adapter results are received:
- filter `list_sessions()` entries before scheduling loads;
- filter summary entries before conversion;
- ensure malformed entries do not consume page positions.
Add conformance tests for invalid UUIDs in both optional listing methods and verify parity between fast and slow paths.
### Environment
- Repository revision: current `main` audit at SDK version 0.2.128
- Bundled CLI version: 2.1.220
- Python test suite: 1,291 passed, 5 skipped
- Ruff and mypy: clean
I searched the existing issues and pull requests using the affected symbols and behavior before filing this.
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
調査の方向性
Read the affected listing paths in src/claude_agent_sdk/_internal/sessions.py and the summary conversion in src/claude_agent_sdk/_internal/session_summary.py, following _validate_uuid() and SessionStore.list_sessions(). Add conformance tests covering invalid UUIDs in both optional listing methods, then verify fast and slow paths filter malformed entries before loading, sorting, or pagination.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- python
- 領域
- backend-api-design
- issue の種類
- バグ
- 難易度
- 3/5
- 見積もり時間
- 1〜2日
- 活発さ
- 静か
- 明瞭さ
- 明確に書かれている
- 初心者へのやさしさ
- 68/100