[pawelangelow]

What

The profiler turns the log file id it receives into a file name. This restricts the id to letters, digits, _ and - (up to 128 characters), which covers the ids the UI generates (_redis_<uuid>), and rejects anything else. The check lives in LogFile, so every caller goes through it, and it also runs before the profiler client is registered, so a rejected request leaves no half-created client behind.

Testing

• Unit tests for LogFile (rejected and accepted ids, file stays inside the temp directory) and for the client provider (rejected before registering the client).
• Integration test over the monitor socket: an id that points outside the temp directory is rejected and no file is created. It fails without the change and passes with it.
• The existing monitor integration test used a Redis-key-shaped id, so it now uses the real _redis_<uuid> format.
• Run locally: profiler unit tests, the monitor integration file against a test Redis, lint and the API type-check.

---

Refs #RI-8400

---

Note

Medium Risk
Changes input validation on a filesystem path derived from user-supplied ids, which closes a path-traversal class of issues but could reject previously tolerated id formats if any clients sent them.

Overview
Adds strict validation for profiler logFileId values because they are used directly as file names under the temp directory. The API now accepts only 1–128 characters matching ^[A-Za-z0-9_-]+$, which matches UI-generated ids like _redis_<uuid> and rejects path segments (.., /, \), empty strings, and overlong ids.

Validation is centralized in LogFile.assertValidId (called from the LogFile constructor) and ProfilerClientProvider.getOrCreateClient runs the same check before registering a profiler client or calling LogFileProvider.getOrCreate, so invalid ids return BadRequestException with the new PROFILER_INVALID_LOG_FILE_ID message without leaving a partial client.

Tests cover refused/accepted id shapes in unit specs, provider behavior on unsafe ids, and a monitor WebSocket integration case that confirms directory-escape ids are rejected and no file is written outside tmpDir. The concurrent monitor test now uses the real _redis_${uuid} id format.

^{Reviewed by Cursor Bugbot for commit 6f07542. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T16:16:44.074453Z	6f07542	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.