OtterMind/Chat2DB · error · IllegalArgumentException

Redis JDBC command arguments cannot contain NUL, CR, or LF

Error message

Redis JDBC command arguments cannot contain NUL, CR, or LF

What it means

Thrown by RedisValueUtils.getRedisValue when the input string contains a NUL (\0), carriage return (\r), or line feed (\n) character. This is a security and integrity guard: Redis JDBC command framing is line-based, so embedded CR/LF/NUL could inject additional commands or corrupt the protocol stream. The check at line 9 rejects these characters before any escaping or quoting is applied.

Source

Thrown at chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/main/java/ai/chat2db/plugin/redis/util/RedisValueUtils.java:10

package ai.chat2db.plugin.redis.util;

public class RedisValueUtils {

    public static String getRedisValue(String value) {
        if (value == null) {
            return null;
        }
        if (value.indexOf('\0') >= 0 || value.indexOf('\r') >= 0 || value.indexOf('\n') >= 0) {
            throw new IllegalArgumentException("Redis JDBC command arguments cannot contain NUL, CR, or LF");
        }
        if (value.contains("\\")) {
            value = value.replace("\\", "\\\\");
        }
        if (value.contains("'")) {
            value = value.replace("'", "\\'");
        }
        if (value.contains("\"")) {
            value = value.replace("\"", "\\\"");
        }
        return "'" + value + "'";
    }
}

View on GitHub (pinned to 5ee1e990e7)

Solutions

1. Sanitize the input to remove or replace \0, \r, and \n before calling getRedisValue
2. Validate user-entered key names at the UI layer to reject control characters
3. Use Base64 or hex encoding for binary key content instead of raw strings

Example fix

// before
String quoted = RedisValueUtils.getRedisValue(userInput);

// after
String sanitized = userInput == null ? null
    : userInput.replace("\0", "").replace("\r", "").replace("\n", "");
String quoted = RedisValueUtils.getRedisValue(sanitized);

public static String sanitizeRedisValue(String value) {
    if (value == null) return null;
    if (value.indexOf('\0') >= 0 || value.indexOf('\r') >= 0 || value.indexOf('\n') >= 0) {
        throw new IllegalArgumentException("Value contains NUL, CR, or LF");
    }
    return value;
}
String safe = sanitizeRedisValue(userInput);
String quoted = RedisValueUtils.getRedisValue(safe);

When it happens

Trigger: Calling RedisValueUtils.getRedisValue(value) where value contains \0, \r, or \n. This is called from RedisScriptExecutor methods (existKey, getKeyType, getTtl, update, createRedisKey) wherever a user-provided key name or value is interpolated into a Redis JDBC command string.

Common situations: User enters a key name with a newline (e.g., from a multiline paste); binary data containing NUL bytes passed as a string key; copy-paste from a source that includes hidden CR characters; malicious input attempting command injection.

Related errors

• Invalid MongoDB database name: {name}
• Invalid MySQL {what}: {value}
• Invalid MySQL definer: {value}
• dataSource.sqlAnalysisError
• Unsafe {what} name: {name}

AI-assisted analysis of OtterMind/Chat2DB@5ee1e990e7 (2026-08-14). Data as JSON: /api/errors/244d780e69459d03. Report an issue: GitHub.