{"record":{"id":"0eca2570a9207990","repo":"CherryHQ/cherry-studio","slug":"invalid-mcp-package-env-null-byte-detected-in-env","errorCode":null,"errorMessage":"Invalid MCP package env: null byte detected in environment variable name","messagePattern":"Invalid MCP package env: null byte detected in environment variable name","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ai/mcp/McpPackageService.ts","lineNumber":257,"sourceCode":"const DXT_ENV_DENYLIST = ['NODE_OPTIONS', 'LD_PRELOAD', 'LD_LIBRARY_PATH']\n\n/**\n * Validate an MCP package environment map and build a new sanitized object.\n * Package env values bypass the command/arg validation, so apply equivalent hardening here:\n * reject null bytes in keys/values and denylist process-affecting variables.\n *\n * @throws Error if a key/value contains a null byte or a key is denylisted\n */\nexport function buildResolvedEnv(\n  env: Record<string, string>,\n  extractDir: string,\n  userConfig?: Record<string, any>\n): Record<string, string> {\n  const resolvedEnv: Record<string, string> = {}\n\n  for (const [key, value] of Object.entries(env)) {\n    if (key.includes('\\0')) {\n      throw new Error('Invalid MCP package env: null byte detected in environment variable name')\n    }\n\n    // Denylist process-affecting variables (DYLD_* on macOS, plus exact matches above).\n    const canonicalKey = key.toUpperCase()\n    if (DXT_ENV_DENYLIST.includes(canonicalKey) || canonicalKey.startsWith('DYLD_')) {\n      throw new Error(`Invalid MCP package env: environment variable \"${key}\" is not allowed`)\n    }\n\n    const substituted = performVariableSubstitution(value, extractDir, userConfig)\n    if (substituted.includes('\\0')) {\n      throw new Error(`Invalid MCP package env: null byte detected in value of environment variable \"${key}\"`)\n    }\n\n    resolvedEnv[key] = substituted\n  }\n\n  return resolvedEnv\n}","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/CherryHQ/cherry-studio/blob/726446b54cd69ffe51a276638672f6d95ca0768c/src/main/ai/mcp/McpPackageService.ts#L239-L275","documentation":"Thrown by buildResolvedEnv while iterating environment variables from an MCP package manifest. A key in the env map contained a NUL (\\0) byte. Null bytes in env keys are a classic injection vector because they can truncate or confuse downstream C-string handling in the spawned process or the OS exec layer. The guard runs after the env map is received from the manifest but before any value substitution, so it inspects the key as authored.","triggerScenarios":"A manifest's server.mcp_config.env (or a platform_overrides env map merged in by applyPlatformOverrides) has a key containing a literal \\0, e.g. \"FOO\\0BAR\". JSON permits escaped control characters, so this can survive parsing intact.","commonSituations":"A hand-edited manifest with a copy-paste error introduced a control character; a malicious or corrupted package was uploaded; a build tool that generated the manifest emitted raw bytes instead of UTF-8 text.","solutions":["Open the package's manifest.json and scan server.mcp_config.env keys (and platform_overrides.env keys) for embedded NUL or other control characters; remove them.","If the manifest was generated, fix the generator to strip control characters from env keys before writing JSON.","Repackage and re-upload; the install is atomic so no partial state remains."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function hasCleanEnvKeys(env: Record<string, string>): boolean {\n  return Object.keys(env).every((k) => !k.includes('\\0'))\n}","typeGuard":"function isCleanEnvKey(key: string): boolean {\n  return typeof key === 'string' && !key.includes('\\0')\n}","tryCatchPattern":null,"preventionTips":["Lint manifest.json files for control characters in keys as part of the package build pipeline.","Treat any env key containing \\0 as a corrupt or hostile package and reject before install.","When generating manifests programmatically, construct keys from a known-safe character set."],"tags":["security","null-byte","mcp","manifest","validation","env"],"backgroundTag":null,"analyzedSha":"726446b54cd69ffe51a276638672f6d95ca0768c","analyzedAt":"2026-08-12T17:30:37.448Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}