SonarSource/sonarqube · error · IllegalArgumentException

Request parameters are not allowed to contain NUL character

Error message

Request parameters are not allowed to contain NUL character

What it means

readParam rejects any request parameter value containing a NUL (\0) character. NUL bytes in HTTP parameters are a classic request-smuggling / injection vector and break downstream string handling, so the library throws IllegalArgumentException defensively.

Solutions

Reject or sanitize the offending client request before it reaches the web service (validate parameter values at the edge).
Decode/inspect the raw query string to find which parameter contains %00 and fix the client producing it.
If needed for testing, remove the NUL character from the parameter value in the test request.

Example fix

// before
String value = "foo\0bar";
request.value("key", value);

// after
String value = sanitize("foo\0bar"); // e.g. value.replace("\0", "")
request.value("key", value);

Defensive patterns

Strategy: validation

Validate before calling

// client-side / edge check
if (value.indexOf('\0') >= 0) {
  throw new IllegalArgumentException("Parameter contains NUL character: " + key);
}

Prevention

Sanitize or reject %00 sequences in incoming URLs at a gateway/proxy.
Never build URLs from raw binary data; URL-encode parameter values.
Treat NUL-containing requests as suspicious (potential injection probing) and log them.

When it happens

Trigger: Calling request.value(key) or request.rawValue(key) (which call readParam) when the incoming HTTP request supplies a parameter value containing a NUL byte, e.g. crafted URLs like %00 or malformed clients.

Common situations: Malicious or broken HTTP clients sending %00 in query parameters; legacy tooling that appends NUL bytes when building URLs; security scans probing for injection.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/8c341baafe70e6b1. Report an issue: GitHub.

Appendix: source

Thrown at sonar-plugin-api-impl/src/main/java/org/sonar/api/impl/ws/ValidatingRequest.java:157

  @Override
  public <E extends Enum<E>> List<E> paramAsEnums(String key, Class<E> enumClass) {
    List<String> values = paramAsStrings(key);
    if (values == null) {
      return null;
    }
    return values.stream()
      .filter(s -> !s.isEmpty())
      .map(value -> Enum.valueOf(enumClass, value))
      .toList();
  }

  @CheckForNull
  private String readParam(String key, @Nullable WebService.Param definition) {
    checkArgument(definition != null, "BUG - parameter '%s' is undefined for action '%s'", key, action.key());
    String deprecatedKey = definition.deprecatedKey();
    String param = deprecatedKey != null ? Objects.toString(readParam(deprecatedKey), readParam(key)) : readParam(key);
    if (param != null && param.contains("\0")) {
      throw new IllegalArgumentException("Request parameters are not allowed to contain NUL character");
    }
    return param;
  }

  private List<String> readMultiParamOrDefaultValue(String key, @Nullable WebService.Param definition) {
    checkArgument(definition != null, "BUG - parameter '%s' is undefined for action '%s'", key, action.key());

    List<String> keyValues = readMultiParam(key);
    if (!keyValues.isEmpty()) {
      return keyValues;
    }

    String deprecatedKey = definition.deprecatedKey();
    List<String> deprecatedKeyValues = deprecatedKey == null ? emptyList() : readMultiParam(deprecatedKey);
    if (!deprecatedKeyValues.isEmpty()) {
      return deprecatedKeyValues;
    }

View on GitHub (pinned to 184c821202)