{"record":{"id":"02fbc861004a15d1","repo":"golang/go","slug":"import-path-contains-nul","errorCode":null,"errorMessage":"import path contains NUL","messagePattern":"import path contains NUL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/compile/internal/noder/import.go","lineNumber":308,"sourceCode":"\tpos := len(data) - len(fingerprint)\n\tif pos < 0 {\n\t\treturn fmt.Errorf(\"missing linker fingerprint in exportdata, but found %q\", data)\n\t}\n\tbuf := []byte(data[pos:])\n\n\tcopy(fingerprint[:], buf)\n\tbase.Ctxt.AddImport(path, fingerprint)\n\n\treturn nil\n}\n\nfunc checkImportPath(path string, allowSpace bool) error {\n\tif path == \"\" {\n\t\treturn errors.New(\"import path is empty\")\n\t}\n\n\tif strings.Contains(path, \"\\x00\") {\n\t\treturn errors.New(\"import path contains NUL\")\n\t}\n\n\tfor ri := range base.ReservedImports {\n\t\tif path == ri {\n\t\t\treturn fmt.Errorf(\"import path %q is reserved and cannot be used\", path)\n\t\t}\n\t}\n\n\tfor _, r := range path {\n\t\tswitch {\n\t\tcase r == utf8.RuneError:\n\t\t\treturn fmt.Errorf(\"import path contains invalid UTF-8 sequence: %q\", path)\n\t\tcase r < 0x20 || r == 0x7f:\n\t\t\treturn fmt.Errorf(\"import path contains control character: %q\", path)\n\t\tcase r == '\\\\':\n\t\t\treturn fmt.Errorf(\"import path contains backslash; use slash: %q\", path)\n\t\tcase !allowSpace && unicode.IsSpace(r):\n\t\t\treturn fmt.Errorf(\"import path contains space character: %q\", path)","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/compile/internal/noder/import.go#L290-L326","documentation":"Thrown by checkImportPath when the import path contains a NUL byte (\\x00). NUL is rejected early because it would corrupt C-string handling and filesystem APIs; it is an immediate, unconditional failure regardless of allowSpace.","triggerScenarios":"An import path string containing '\\x00' is passed to checkImportPath. Typically the result of a corrupted file, a truncation bug, or unsafe string slicing that leaves an embedded NUL.","commonSituations":"Corrupted source files or archives; buggy code generation that concatenates without bounds checks; tooling that reads fixed-width records and leaves NUL padding; security-sensitive input that must never contain NUL.","solutions":["Sanitize/trim NUL bytes from any external string before it becomes an import path.","Regenerate the offending source file if it is corrupted.","Audit string-handling code (C-string interop, fixed buffers) that may introduce NULs."],"exampleFix":"// before\npath := \"pkg\\x00evil\"\n// after\npath := strings.Trim(path, \"\\x00\")\n// or reject entirely:\nif strings.Contains(path, \"\\x00\") { return errors.New(\"bad path\") }","handlingStrategy":"validation","validationCode":"// Reject import paths containing NUL or other control bytes.\nimport (\"strings\")\nfunc cleanImportPath(p string) bool { return !strings.Contains(p, \"\\x00\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize all externally-sourced strings before they become import paths.","Regenerate corrupted source files rather than patching them.","Audit C-string/buffer interop that can introduce NUL bytes."],"tags":["compiler","imports","validation","nul","sanitization"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}