Validate module names in the memiavl snapshot importer

[masih]

MultiTreeImporter.AddModule used the module name from the snapshot stream as a path component without validating it. Real module names are store keys, so anything other than a plain directory name means the snapshot is malformed.

AddModule now rejects empty, ., .., absolute and multi-component names before it creates any files, so such a snapshot fails early with a clear error. Valid snapshots import exactly as before and the AppHash is unchanged.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access that start with 'Devin'.

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Oct 6, 2026, 10:46 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.80%. Comparing base (7a2ec6e) to head (1c71b99).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4469   +/-   ##
=======================================
  Coverage   56.80%   56.80%           
=======================================
  Files        2127     2127           
  Lines      167022   167027    +5     
=======================================
+ Hits        94879    94888    +9     
+ Misses      72138    72134    -4     
  Partials        5        5           

Flag	Coverage Δ
sei-chain	54.98% <ø> (+<0.01%)	⬆️
sei-db	75.17% <ø> (ø)
sei-db-state-db	78.88% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
sei-db/state_db/sc/memiavl/import.go	77.12% <100.00%> (+1.17%)	⬆️

... and 28 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

PR Summary

Medium Risk
Touches snapshot restore path handling; low blast radius for valid snapshots but blocks previously accepted malformed names and prevents path-component abuse during import.

Overview
Snapshot restore now rejects unsafe or malformed module names before any import directories are created.

MultiTreeImporter.AddModule validates names with validateModuleName (plain local segment only: no empty, ., .., slashes, or absolute paths) and returns invalid snapshot module name on failure. Root-multi restore tests expect that error for an unnamed store item; memiavl adds TestMultiTreeImporterValidatesModuleName to cover bad names and confirm valid modules (e.g. bank) still import under the snapshot temp dir without path traversal.

^{Reviewed by Cursor Bugbot for commit 1c71b99. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

review found nothing blocking in the commit it read. It does not approve: this pull request was pushed to while the review ran, so the approval would stand against code the review never saw. Ask for another review to have the new commit read.

[seidroid]

This change makes MultiTreeImporter.AddModule reject any snapshot module name that is not a plain single directory name (empty, ., .., absolute, or containing a separator) before it joins the name onto the import temp dir. That closes the path-traversal hole for module names that come from peers during state sync, restore in rootmulti already aborts on the returned error, and I found nothing blocking. The one other reading (codex) found nothing, which matches my reading; the tests could not be run because this sandbox has no Go toolchain.

_{seidroid review · decision approve · session 91cb333bade445ca9b0b1c5e206cc88f · turn resp_claude_a78a94e578b3b2ff9357bfd8d3a17796 · item ccf47ec6cbce5e769f2e36e93b76dfbd}

Findings: 0 blocking | 0 non-blocking | 0 posted inline

[seidroid]

Since my last review only the doc comment, the test name and fixture wording and the PR description have changed; validateModuleName and the AddModule guard are identical, so names that would leave the memiavl import temp dir are still rejected, and I raised nothing before that needed addressing. Nothing blocks; the one other reading (codex) found nothing, which matches mine, and the tests were not run because this sandbox has no Go toolchain.

_{seidroid review · decision approve · session 91cb333bade445ca9b0b1c5e206cc88f · turn resp_claude_95e4a8270bb4cb4f5a1f0a8b3b85b60a · item 8806d07bebab51b7942be1f02a178662}

Findings: 0 blocking | 0 non-blocking | 0 posted inline

[seidroid]

Created backport PR for release/v6.7:

• Backport release/v6.7: Validate module names in the memiavl snapshot importer #4474 with remaining conflicts!

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-4469-to-release/v6.7
git worktree add --checkout .worktree/backport-4469-to-release/v6.7 backport-4469-to-release/v6.7
cd .worktree/backport-4469-to-release/v6.7
git reset --hard HEAD^
git cherry-pick -x 96e048374c34995998a4a15ab12dced82c4201b3
git push --force-with-lease