fix: address review pass 6 - result cap, canonical path, skip stale s…

…earch - Cap search results at 100 and stop scanning early - Use canonical path validation instead of substring matching for path traversal prevention - Skip stale debounced search after project switch to avoid unnecessary backend I/O Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
josegtmonteiro · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026 · Mar 13, 2026
commit 2eafdc2005697ff848092da3f5cc185e1ca00075
diff --git a/src-tauri/src/commands/claude.rs b/src-tauri/src/commands/claude.rs
@@ -602,24 +602,34 @@ pub async fn search_project_sessions(
     );
 
     // Validate project_id to prevent path traversal
-    if project_id.is_empty()
-        || project_id.contains('/')
-        || project_id.contains('\\')
-        || project_id.contains("..")
-    {
+    if project_id.is_empty() || project_id.contains('/') || project_id.contains('\\') {
         return Err("Invalid project id".to_string());
     }
 
     let query_lower = query.to_lowercase();
     let claude_dir = get_claude_dir().map_err(|e| e.to_string())?;
-    let project_dir = claude_dir.join("projects").join(&project_id);
+    let projects_dir = claude_dir.join("projects");
+    let project_dir = projects_dir.join(&project_id);
+
+    // Verify resolved path stays under the projects root
+    let canonical_projects_dir = projects_dir
+        .canonicalize()
+        .map_err(|e| e.to_string())?;
+    let canonical_project_dir = project_dir
+        .canonicalize()
+        .map_err(|_| format!("Project directory not found: {}", project_id))?;
+    if !canonical_project_dir.starts_with(&canonical_projects_dir) {
+        return Err("Invalid project id".to_string());
+    }
     let todos_dir = claude_dir.join("todos");
 
     if !project_dir.exists() {
         return Err(format!("Project directory not found: {}", project_id));
     }
 
     tokio::task::spawn_blocking(move || {
+        const MAX_RESULTS: usize = 100;
+
         let project_path = match get_project_path_from_sessions(&project_dir) {
             Ok(path) => path,
             Err(_) => decode_project_path(&project_id),
@@ -631,6 +641,10 @@ pub async fn search_project_sessions(
             .map_err(|e| format!("Failed to read project directory: {}", e))?;
 
         for entry in entries {
+            if sessions.len() >= MAX_RESULTS {
+                break;
+            }
+
             let entry = entry.map_err(|e| format!("Failed to read directory entry: {}", e))?;
             let path = entry.path();
 

diff --git a/src/components/SessionList.tsx b/src/components/SessionList.tsx
@@ -71,9 +71,11 @@ export const SessionList: React.FC<SessionListProps> = ({
   const [searching, setSearching] = useState(false);
   const debouncedQuery = useDebounce(searchQuery, 300);
   const searchRequestId = useRef(0);
+  const skipNextSearch = useRef(false);
 
   // Hard reset when project context changes
   useEffect(() => {
+    skipNextSearch.current = true;
     searchRequestId.current += 1;
     setSearchQuery("");
     setSearchResults(null);
@@ -95,6 +97,10 @@ export const SessionList: React.FC<SessionListProps> = ({
 
   // Perform search when debounced query changes
   useEffect(() => {
+    if (skipNextSearch.current) {
+      skipNextSearch.current = false;
+      return;
+    }
     if (!debouncedQuery.trim()) {
       setSearchResults(null);
       setSearchError(null);