From 3e09508e6eaaf339668ae434824aa54ae32ca7ae Mon Sep 17 00:00:00 2001
From: ice-black-tea <30665081+ice-black-tea@users.noreply.github.com>
Date: Sun, 15 Nov 2026 06:25:54 +0800
Subject: [PATCH] fix(ai): reject non-url-safe record cursor characters

---
 linktools-ai/src/linktools/ai/persistence/_repository_common.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/linktools-ai/src/linktools/ai/persistence/_repository_common.py b/linktools-ai/src/linktools/ai/persistence/_repository_common.py
index 8ed58bde9a..f30d304214 100644
--- a/linktools-ai/src/linktools/ai/persistence/_repository_common.py
+++ b/linktools-ai/src/linktools/ai/persistence/_repository_common.py
@@ -1209,6 +1209,8 @@ def _decode_record_cursor(cursor: str | None) -> tuple[bytes | None, bytes | Non
     try:
         if not isinstance(cursor, str) or not cursor:
             raise ValueError("cursor length")
+        if "+" in cursor or "/" in cursor:
+            raise ValueError("cursor encoding")
         raw = base64.b64decode(cursor + "=" * (-len(cursor) % 4), altchars=b"-_", validate=True)
         key_size = int.from_bytes(raw[:2], "big")
         if not 1 <= key_size <= RECORD_KEY_MAX_BYTES or len(raw) <= 2 + key_size: