{"record":{"id":"0dfdd964ef9e281c","repo":"shadowsocks/shadowsocks-rust","slug":"syslog-identity-contains-null-byte-0","errorCode":null,"errorMessage":"syslog identity contains null-byte ('\\0')","messagePattern":"syslog identity contains null-byte \\('\\\\0'\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/logging/tracing.rs","lineNumber":213,"sourceCode":"            4 => Facility::Auth,\n            6 => Facility::Lpr,\n            7 => Facility::News,\n            8 => Facility::Uucp,\n            9 => Facility::Cron,\n            10 => Facility::AuthPriv,\n            16 => Facility::Local0,\n            17 => Facility::Local1,\n            18 => Facility::Local2,\n            19 => Facility::Local3,\n            20 => Facility::Local4,\n            21 => Facility::Local5,\n            22 => Facility::Local6,\n            23 => Facility::Local7,\n            _ => panic!(\"unsupported syslog facility: {}\", f),\n        },\n    };\n    let options = Options::default();\n    let identity = CString::new(identity).expect(\"syslog identity contains null-byte ('\\\\0')\");\n\n    match Syslog::new(identity, options, facility) {\n        Some(l) => l,\n        None => panic!(\"syslog is already initialized\"),\n    }\n}\n","sourceCodeStart":195,"sourceCodeEnd":220,"githubUrl":"https://github.com/shadowsocks/shadowsocks-rust/blob/8eb0f0a65b1d976ab6bed5787327ef86529b0435/src/logging/tracing.rs#L195-L220","documentation":"make_syslog_writer builds a syslog writer whose identity (program name tag) must be a C-compatible NUL-terminated string. CString::new fails if the caller-supplied identity contains a '\\0' byte, and the .expect turns that into a panic with this message. The library refuses to silently truncate or sanitize the identity, so it aborts instead.","triggerScenarios":"Calling make_syslog_writer (via make_layer) with an identity string containing an embedded NUL byte, e.g. an identity read from an environment variable, argv, or config file that includes '\\0'.","commonSituations":"Binary/unsafe input sourced into a logging identity; misparsed command-line arguments; a config value that was decoded from a byte buffer without NUL stripping; FFI-passed strings that kept their terminator.","solutions":["Sanitize the identity before passing it in: strip or replace any '\\0' characters.","Validate the identity at config-load time and reject NUL bytes early with a clear user-facing error.","If the identity comes from env/args, trim it and check identity.contains('\\0') before calling make_syslog_writer."],"exampleFix":"// before\nlet identity = std::env::var(\"SYSLOG_IDENTITY\").unwrap();\nlet writer = make_syslog_writer(facility, &identity);\n\n// after\nlet identity = std::env::var(\"SYSLOG_IDENTITY\").unwrap();\nlet identity = identity.replace('\\0', \"\");\nassert!(!identity.contains('\\0'), \"syslog identity must not contain NUL\");\nlet writer = make_syslog_writer(facility, &identity);","handlingStrategy":"validation","validationCode":"fn validate_syslog_identity(identity: &str) -> Result<(), String> {\n    if identity.contains('\\0') {\n        Err(format!(\"syslog identity contains null-byte: {:?}\", identity))\n    } else {\n        Ok(())\n    }\n}","typeGuard":"fn is_nul_free(s: &str) -> bool { !s.as_bytes().contains(&b'\\0') }","tryCatchPattern":"let identity = CString::new(identity)\n    .map_err(|_| format!(\"syslog identity contains null-byte: {:?}\", identity))?;","preventionTips":["Strip NUL bytes from any identity sourced from env vars, argv, or config files.","Sanitize all byte-buffer-derived strings before they become C-string inputs.","Add a config-load-time check that rejects control characters in identity fields."],"tags":["rust","logging","syslog","panic"],"backgroundTag":"invalid-argument-value","analyzedSha":"8eb0f0a65b1d976ab6bed5787327ef86529b0435","analyzedAt":"2026-09-09T12:20:43.168Z","contentChangedAt":"2026-09-09T12:20:43.168Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}