Tencent/WeKnora · error

argument %d contains null bytes

Error message

argument %d contains null bytes

What it means

ValidateStdioArgs rejects arguments containing NUL bytes (\x00). Null bytes can truncate C-string handling in spawned processes and are a classic injection/evasion vector, so any argument containing one is rejected.

Source

Thrown at internal/utils/security.go:580

		return nil
	}

	for i, arg := range args {
		// Check length
		if len(arg) > 1024 {
			return fmt.Errorf("argument %d exceeds maximum length (1024 characters)", i)
		}

		// Check against dangerous patterns
		for _, pattern := range DangerousArgPatterns {
			if pattern.MatchString(arg) {
				return fmt.Errorf("argument %d contains potentially dangerous pattern: %s", i, SanitizeForLog(arg))
			}
		}

		// Check for null bytes
		if strings.Contains(arg, "\x00") {
			return fmt.Errorf("argument %d contains null bytes", i)
		}
	}

	return nil
}

// ValidateStdioEnvVars validates environment variables for MCP stdio transport
// Returns an error if any env var name or value is dangerous
func ValidateStdioEnvVars(envVars map[string]string) error {
	if len(envVars) == 0 {
		return nil
	}

	for key, value := range envVars {
		// Check key against dangerous patterns
		for _, pattern := range DangerousEnvVarPatterns {
			if pattern.MatchString(key) {
				return fmt.Errorf("environment variable '%s' is not allowed for security reasons", key)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Strip NUL bytes from the input: strings.ReplaceAll(arg, "\x00", "") or reject the input upstream
2. If binary data must be passed, encode it (base64/hex) and decode inside the target program
3. Fix the encoding path that produced the NUL bytes (e.g. UTF-16LE to UTF-8 conversion)

Example fix

// before
arg := string(rawBytes) // may contain \x00
// after
arg := base64.StdEncoding.EncodeToString(rawBytes) // pass encoded, decode in target

for i, a := range cfg.Args {
    if strings.Contains(a, "\x00") {
        return fmt.Errorf("args[%d] contains null bytes", i)
    }
}

if err := ValidateStdioConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "null bytes") {
        return fmt.Errorf("encode binary args (e.g. base64) before passing: %w", err)
    }
    return err
}

When it happens

Trigger: An args element contains an embedded NUL byte — typically from binary data, improperly decoded buffers, or corrupted input passed as a string.

Common situations: Passing binary payloads or buffer slices converted to strings; reading user uploads as raw bytes into an arg; encoding bugs (UTF-16 converted naively producing \x00 between chars).

Related errors

• MCP service URL failed SSRF validation: %w
• command cannot be empty
• command '%s' is not in the allowed list. Allowed commands: u
• command path contains invalid characters
• argument %d exceeds maximum length (1024 characters)

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/8958553312641461. Report an issue: GitHub.