{"record":{"id":"0e926fa72222cc48","repo":"CherryHQ/cherry-studio","slug":"invalid-args-null-byte-detected-in-argument-at-in","errorCode":null,"errorMessage":"Invalid args: null byte detected in argument at index ${index}","messagePattern":"Invalid args: null byte detected in argument at index (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ai/mcp/McpPackageService.ts","lineNumber":184,"sourceCode":" * Rejects arguments containing path traversal sequences.\n *\n * @param args - The arguments array to validate\n * @returns The validated arguments array\n * @throws Error if any argument contains path traversal\n */\nexport function validateArgs(args: string[]): string[] {\n  if (!Array.isArray(args)) {\n    throw new Error('Invalid args: must be an array')\n  }\n\n  return args.map((arg, index) => {\n    if (typeof arg !== 'string') {\n      throw new Error(`Invalid args: argument at index ${index} must be a string`)\n    }\n\n    // Check for null bytes\n    if (arg.includes('\\0')) {\n      throw new Error(`Invalid args: null byte detected in argument at index ${index}`)\n    }\n\n    // Check for path traversal in arguments that look like paths\n    // Only validate if the arg contains path separators (indicating it's meant to be a path)\n    if ((arg.includes('/') || arg.includes('\\\\')) && /(?:^|[/\\\\])\\.\\.(?:[/\\\\]|$)/.test(arg)) {\n      throw new Error(`Invalid args: path traversal detected in argument at index ${index}`)\n    }\n\n    return arg\n  })\n}\n\nexport function performVariableSubstitution(\n  value: string,\n  extractDir: string,\n  userConfig?: Record<string, any>\n): string {\n  let result = value","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/CherryHQ/cherry-studio/blob/726446b54cd69ffe51a276638672f6d95ca0768c/src/main/ai/mcp/McpPackageService.ts#L166-L202","documentation":"Thrown by validateArgs() during the per-element map when an argument string contains a null byte (\\0, U+0000). Like the command null-byte check (error 156), this prevents null-byte injection through command arguments, where a null byte could truncate or alter the argument as seen by the underlying process spawn. The check runs after the type check but before the path-traversal check.","triggerScenarios":"Called from resolveMcpConfig at line 359. Triggers when any element in the args array contains a \\0 character. This could come from a malicious manifest, binary user_config values, or encoding corruption. The error message includes the index of the offending argument.","commonSituations":"A malicious MCP package embeds null bytes in arguments to bypass downstream argument parsing; a file path argument was read from a binary file; encoding corruption during cross-platform transfer; a user_config value sourced from untrusted input contained raw bytes.","solutions":["Sanitize all argument strings and user_config values to strip null bytes before validation.","Audit the manifest's args array for any non-printable characters.","Do not install packages whose manifests contain null bytes in arguments."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Strip null bytes from all args before validation (if input is trusted)\nconst cleaned = args.map(arg => typeof arg === 'string' ? arg.replace(/\\0/g, '') : arg)\n// Or reject outright\nconst nullIndex = args.findIndex(arg => typeof arg === 'string' && arg.includes('\\0'))\nif (nullIndex >= 0) {\n  throw new Error(`Argument at index ${nullIndex} contains null bytes`)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat null bytes in arguments as a security incident.","Sanitize all variable-substitution sources to strip null bytes.","Audit manifests for non-printable characters in arguments before installation."],"tags":["security","null-byte","mcp","command-injection","manifest"],"backgroundTag":null,"analyzedSha":"726446b54cd69ffe51a276638672f6d95ca0768c","analyzedAt":"2026-08-12T17:30:37.448Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}