cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [data-flow] ContextManager.import_context() writes unsanitized external data directly to disk without any validation #7352

New issue

Open

opened 2026-04-10 18:00:15 +00:00 by HAL9000 · 4 comments

HAL9000 commented

2026-04-10 18:00:15 +00:00

Owner

Bug Report: [data-flow] ContextManager.import_context() deserializes and persists external JSON data without validation allowing arbitrary context manipulation

Severity Assessment

Impact: A malicious or malformed context export file can inject arbitrary keys into the messages, state, metadata, and global_context dicts, potentially manipulating routing decisions, session history, or injecting malicious messages into agent conversations
Likelihood: Medium — if context files are shared between users or loaded from untrusted sources
Priority: High

Location

File: src/cleveragents/reactive/context_manager.py
Function/Class: ContextManager.import_context()
Lines: ~115-125

Description

The import_context() method reads a JSON file and directly assigns its contents to the messages, metadata, state, and global_context fields without any validation:

No schema validation: No check that the imported data has the expected structure
No type checking: messages could be a string, an integer, or a dict — any type will be assigned
No content sanitization: Message content could contain injection payloads
No size limits: A crafted import file could contain millions of messages, exhausting memory
Path traversal: The context_file path is not validated, allowing imports from outside the context directory

The messages are later used in get_conversation_history() and get_last_n_messages() which assume they're a list of dicts with role, content, timestamp keys. If imported messages have unexpected types, this could cause crashes or injection.

Evidence

def import_context(self, context_file: Path) -> None:
    with open(context_file, encoding="utf-8") as f:
        data = json.load(f)
    # BUG: No validation at all!
    self.messages = data.get("messages", [])       # Could be any type!
    self.metadata = data.get("metadata", self._load_metadata())  # Could be any type!
    self.state = data.get("state", {})              # Could be any type!
    self.global_context = data.get("global_context", {})  # Could be any type!
    self.save()  # Persists potentially malicious data to disk immediately!

Compare with export_context() which exports without any validation:

def export_context(self, export_file: Path) -> None:
    data = {
        "context_name": self.context_name,
        "messages": self.messages,
        # ...
    }
    with open(export_file, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2)  # No version or integrity signature

There is no integrity signature or version check, so a modified export file is indistinguishable from a legitimate one.

Expected Behavior

The import_context() method should:

Validate that messages is a list, each element is a dict with required keys (role, content, timestamp)
Validate that role values are from an allowlist
Limit the number of messages that can be imported
Sanitize message content to prevent injection
Version-check the import format

Actual Behavior

Any JSON file can be loaded as a context, injecting arbitrary data into the agent's conversation history, state, or routing context without any validation or sanitization.

Suggested Fix

def import_context(self, context_file: Path) -> None:
    with open(context_file, encoding="utf-8") as f:
        data = json.load(f)
    
    # Validate structure
    messages = data.get("messages", [])
    if not isinstance(messages, list):
        raise ValueError("Invalid context: 'messages' must be a list")
    if len(messages) > 10_000:  # Reasonable limit
        raise ValueError(f"Invalid context: too many messages ({len(messages)})")
    
    allowed_roles = {"user", "assistant", "system", "tool"}
    for i, msg in enumerate(messages):
        if not isinstance(msg, dict):
            raise ValueError(f"Invalid message at index {i}: must be a dict")
        if msg.get("role") not in allowed_roles:
            raise ValueError(f"Invalid role at index {i}: {msg.get('role')!r}")
        if not isinstance(msg.get("content", ""), str):
            raise ValueError(f"Invalid content at index {i}: must be a string")
    
    self.messages = messages
    self.metadata = data.get("metadata") or self._load_metadata()
    self.state = data.get("state") or {}
    self.global_context = data.get("global_context") or {}
    self.save()

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_, and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Detection Pool | Agent: bug-hunt-pool-supervisor

## Bug Report: [data-flow] ContextManager.import_context() deserializes and persists external JSON data without validation allowing arbitrary context manipulation ### Severity Assessment - **Impact**: A malicious or malformed context export file can inject arbitrary keys into the `messages`, `state`, `metadata`, and `global_context` dicts, potentially manipulating routing decisions, session history, or injecting malicious messages into agent conversations - **Likelihood**: Medium — if context files are shared between users or loaded from untrusted sources - **Priority**: High ### Location - **File**: `src/cleveragents/reactive/context_manager.py` - **Function/Class**: `ContextManager.import_context()` - **Lines**: ~115-125 ### Description The `import_context()` method reads a JSON file and directly assigns its contents to the `messages`, `metadata`, `state`, and `global_context` fields **without any validation**: 1. **No schema validation**: No check that the imported data has the expected structure 2. **No type checking**: `messages` could be a string, an integer, or a dict — any type will be assigned 3. **No content sanitization**: Message content could contain injection payloads 4. **No size limits**: A crafted import file could contain millions of messages, exhausting memory 5. **Path traversal**: The `context_file` path is not validated, allowing imports from outside the context directory The `messages` are later used in `get_conversation_history()` and `get_last_n_messages()` which assume they're a list of dicts with `role`, `content`, `timestamp` keys. If imported messages have unexpected types, this could cause crashes or injection. ### Evidence ```python def import_context(self, context_file: Path) -> None: with open(context_file, encoding="utf-8") as f: data = json.load(f) # BUG: No validation at all! self.messages = data.get("messages", []) # Could be any type! self.metadata = data.get("metadata", self._load_metadata()) # Could be any type! self.state = data.get("state", {}) # Could be any type! self.global_context = data.get("global_context", {}) # Could be any type! self.save() # Persists potentially malicious data to disk immediately! ``` Compare with `export_context()` which exports without any validation: ```python def export_context(self, export_file: Path) -> None: data = { "context_name": self.context_name, "messages": self.messages, # ... } with open(export_file, "w", encoding="utf-8") as f: json.dump(data, f, indent=2) # No version or integrity signature ``` There is no integrity signature or version check, so a modified export file is indistinguishable from a legitimate one. ### Expected Behavior The `import_context()` method should: 1. Validate that `messages` is a list, each element is a dict with required keys (`role`, `content`, `timestamp`) 2. Validate that `role` values are from an allowlist 3. Limit the number of messages that can be imported 4. Sanitize message content to prevent injection 5. Version-check the import format ### Actual Behavior Any JSON file can be loaded as a context, injecting arbitrary data into the agent's conversation history, state, or routing context without any validation or sanitization. ### Suggested Fix ```python def import_context(self, context_file: Path) -> None: with open(context_file, encoding="utf-8") as f: data = json.load(f) # Validate structure messages = data.get("messages", []) if not isinstance(messages, list): raise ValueError("Invalid context: 'messages' must be a list") if len(messages) > 10_000: # Reasonable limit raise ValueError(f"Invalid context: too many messages ({len(messages)})") allowed_roles = {"user", "assistant", "system", "tool"} for i, msg in enumerate(messages): if not isinstance(msg, dict): raise ValueError(f"Invalid message at index {i}: must be a dict") if msg.get("role") not in allowed_roles: raise ValueError(f"Invalid role at index {i}: {msg.get('role')!r}") if not isinstance(msg.get("content", ""), str): raise ValueError(f"Invalid content at index {i}: must be a string") self.messages = messages self.metadata = data.get("metadata") or self._load_metadata() self.state = data.get("state") or {} self.global_context = data.get("global_context") or {} self.save() ``` ### Category data-flow ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Detection Pool | Agent: bug-hunt-pool-supervisor

HAL9000 referenced this issue

2026-04-10 18:08:49 +00:00

[AUTO-BUG-SUP] Bug Hunt Status (Cycle 1) #7340

HAL9000 added the

State

Unverified

label

2026-04-10 18:37:42 +00:00

HAL9000 added this to the v3.4.0 milestone

2026-04-10 18:43:51 +00:00

HAL9000 commented

2026-04-10 18:55:09 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified — Unsanitized context import is a real security/data-integrity bug
Priority: Priority/Critical — arbitrary data injection into agent conversation history is a security vulnerability
Milestone: v3.4.0 — ContextManager is part of ACMS v1 (context management system)
Type: Type/Bug
MoSCoW: Must Have — context integrity is required for ACMS v1 to be production-ready

The fix requires schema validation on import: type checking, role allowlist, size limits.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

Issue triaged by project owner: - **State**: Verified — Unsanitized context import is a real security/data-integrity bug - **Priority**: Priority/Critical — arbitrary data injection into agent conversation history is a security vulnerability - **Milestone**: v3.4.0 — ContextManager is part of ACMS v1 (context management system) - **Type**: Type/Bug - **MoSCoW**: Must Have — context integrity is required for ACMS v1 to be production-ready The fix requires schema validation on import: type checking, role allowlist, size limits. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-10 19:14:22 +00:00

[AUTO-OWNR] Project Owner Status (Cycle 1) #7369

freemo added the

labels

2026-04-12 18:35:49 +00:00

HAL9000 added

and removed

labels

2026-04-14 06:23:51 +00:00

HAL9000 commented

2026-04-14 06:23:52 +00:00

Author

Owner

✅ Verified — Critical security bug: ContextManager writes unsanitized external data to disk. MoSCoW: Must-have. Priority: Critical — path traversal/injection risk.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Critical security bug: ContextManager writes unsanitized external data to disk. MoSCoW: Must-have. Priority: Critical — path traversal/injection risk. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:29:30 +00:00

Author

Owner

✅ Verified — Critical security bug: ContextManager writes unsanitized external data to disk. MoSCoW: Must-have. Priority: Critical — path traversal/injection risk.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:36:03 +00:00

Author

Owner

✅ Verified — Critical security bug: ContextManager writes unsanitized external data to disk. MoSCoW: Must-have. Priority: Critical — path traversal/injection risk.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor