From a1ea1f24b9249bacd81981e6895c950bf1829776 Mon Sep 17 00:00:00 2001
From: "jinli.yl" <jinli.yl@alibaba-inc.com>
Date: Mon, 9 Feb 2026 11:29:46 +0800
Subject: [PATCH] feat(memory_store): add input validation for store_name to
 prevent SQL injection

---
 reme/core/memory_store/base_memory_store.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/reme/core/memory_store/base_memory_store.py b/reme/core/memory_store/base_memory_store.py
index ed8f59e7..3357e282 100644
--- a/reme/core/memory_store/base_memory_store.py
+++ b/reme/core/memory_store/base_memory_store.py
@@ -1,5 +1,6 @@
 """Base storage interface for memory manager."""
 
+import re
 from abc import ABC, abstractmethod
 
 from ..embedding import BaseEmbeddingModel
@@ -19,6 +20,13 @@ class BaseMemoryStore(ABC):
         **kwargs,
     ):
         """Initialize"""
+        # Validate store_name to prevent SQL injection
+        # Only allow alphanumeric characters and underscores
+        if not re.match(r"^[a-zA-Z0-9_]+$", store_name):
+            raise ValueError(
+                f"Invalid store_name: '{store_name}'. "
+                "Only alphanumeric characters and underscores are allowed."
+            )
         self.store_name: str = store_name
         self.embedding_model: BaseEmbeddingModel = embedding_model
         self.fts_enabled: bool = fts_enabled