{"record":{"id":"1a0ca6f02cd62421","repo":"hashicorp/nomad","slug":"task-group-name-contains-null-character","errorCode":null,"errorMessage":"Task group name contains null character","messagePattern":"Task group name contains null character","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":7130,"sourceCode":"\t}\n\tfor _, task := range tg.Tasks {\n\t\tfor _, service := range task.Services {\n\t\t\tif f(service) {\n\t\t\t\tservices = append(services, service)\n\t\t\t}\n\t\t}\n\t}\n\treturn services\n}\n\n// Validate is used to check a task group for reasonable configuration\nfunc (tg *TaskGroup) Validate(j *Job) error {\n\tvar mErr *multierror.Error\n\n\tif tg.Name == \"\" {\n\t\tmErr = multierror.Append(mErr, errors.New(\"Missing task group name\"))\n\t} else if strings.Contains(tg.Name, \"\\000\") {\n\t\tmErr = multierror.Append(mErr, errors.New(\"Task group name contains null character\"))\n\t}\n\n\tif tg.Count < 0 {\n\t\tmErr = multierror.Append(mErr, errors.New(\"Task group count can't be negative\"))\n\t}\n\n\tif len(tg.Tasks) == 0 {\n\t\t// could be a lone consul gateway inserted by the connect mutator\n\t\tmErr = multierror.Append(mErr, errors.New(\"Missing tasks for task group\"))\n\t}\n\n\tif tg.Disconnect != nil {\n\t\tif err := tg.Disconnect.Validate(j); err != nil {\n\t\t\tmErr = multierror.Append(mErr, err)\n\t\t}\n\t}\n\n\tif tg.MaxRunDuration != nil {","sourceCodeStart":7112,"sourceCodeEnd":7148,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L7112-L7148","documentation":"TaskGroup.Validate rejects task group names containing the NUL character (\\000), since names are used in internal keys, allocation identifiers, and service discovery entries where null bytes are illegal.","triggerScenarios":"Submitting a job whose group name contains a literal \\u0000, usually from untrusted/unsanitized input interpolated into the name.","commonSituations":"Generating group names from user input or environment data that includes null bytes; JSON parsing of malformed input embedding \\u0000.","solutions":["Sanitize group names, stripping control characters before submitting.","Validate names against a safe pattern (letters, digits, dashes) at intake.","Use nomad job validate on generated specs."],"exampleFix":"// before\nname := strings.ReplaceAll(userInput, \"\\x00\", \"\") // was missing\n// after\nif strings.Contains(name, \"\\x00\") { return fmt.Errorf(\"invalid group name\") }","handlingStrategy":"validation","validationCode":"if strings.Contains(tg.Name, \"\\x00\") {\n    return errors.New(\"task group name contains null character\")\n}","typeGuard":"func safeName(s string) bool { return s != \"\" && !strings.ContainsAny(s, \"\\x00\") }","tryCatchPattern":null,"preventionTips":["Sanitize all user-supplied names before interpolating into job specs","Reject control characters at input boundaries","Validate generated specs with nomad job validate"],"tags":["nomad","job-validation","invalid-characters"],"backgroundTag":"invalid-identifier-characters","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}