{"record":{"id":"244d780e69459d03","repo":"OtterMind/Chat2DB","slug":"redis-jdbc-command-arguments-cannot-contain-nul-c","errorCode":null,"errorMessage":"Redis JDBC command arguments cannot contain NUL, CR, or LF","messagePattern":"Redis JDBC command arguments cannot contain NUL, CR, or LF","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/main/java/ai/chat2db/plugin/redis/util/RedisValueUtils.java","lineNumber":10,"sourceCode":"package ai.chat2db.plugin.redis.util;\n\npublic class RedisValueUtils {\n\n    public static String getRedisValue(String value) {\n        if (value == null) {\n            return null;\n        }\n        if (value.indexOf('\\0') >= 0 || value.indexOf('\\r') >= 0 || value.indexOf('\\n') >= 0) {\n            throw new IllegalArgumentException(\"Redis JDBC command arguments cannot contain NUL, CR, or LF\");\n        }\n        if (value.contains(\"\\\\\")) {\n            value = value.replace(\"\\\\\", \"\\\\\\\\\");\n        }\n        if (value.contains(\"'\")) {\n            value = value.replace(\"'\", \"\\\\'\");\n        }\n        if (value.contains(\"\\\"\")) {\n            value = value.replace(\"\\\"\", \"\\\\\\\"\");\n        }\n        return \"'\" + value + \"'\";\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":24,"githubUrl":"https://github.com/OtterMind/Chat2DB/blob/5ee1e990e73fbcae1969dc554be254fedb3ab888/chat2db-community-server/chat2db-community-plugins/chat2db-community-redis/src/main/java/ai/chat2db/plugin/redis/util/RedisValueUtils.java#L1-L24","documentation":"Thrown by RedisValueUtils.getRedisValue when the input string contains a NUL (\\0), carriage return (\\r), or line feed (\\n) character. This is a security and integrity guard: Redis JDBC command framing is line-based, so embedded CR/LF/NUL could inject additional commands or corrupt the protocol stream. The check at line 9 rejects these characters before any escaping or quoting is applied.","triggerScenarios":"Calling RedisValueUtils.getRedisValue(value) where value contains \\0, \\r, or \\n. This is called from RedisScriptExecutor methods (existKey, getKeyType, getTtl, update, createRedisKey) wherever a user-provided key name or value is interpolated into a Redis JDBC command string.","commonSituations":"User enters a key name with a newline (e.g., from a multiline paste); binary data containing NUL bytes passed as a string key; copy-paste from a source that includes hidden CR characters; malicious input attempting command injection.","solutions":["Sanitize the input to remove or replace \\0, \\r, and \\n before calling getRedisValue","Validate user-entered key names at the UI layer to reject control characters","Use Base64 or hex encoding for binary key content instead of raw strings"],"exampleFix":"// before\nString quoted = RedisValueUtils.getRedisValue(userInput);\n\n// after\nString sanitized = userInput == null ? null\n    : userInput.replace(\"\\0\", \"\").replace(\"\\r\", \"\").replace(\"\\n\", \"\");\nString quoted = RedisValueUtils.getRedisValue(sanitized);","handlingStrategy":"validation","validationCode":"public static String sanitizeRedisValue(String value) {\n    if (value == null) return null;\n    if (value.indexOf('\\0') >= 0 || value.indexOf('\\r') >= 0 || value.indexOf('\\n') >= 0) {\n        throw new IllegalArgumentException(\"Value contains NUL, CR, or LF\");\n    }\n    return value;\n}\nString safe = sanitizeRedisValue(userInput);\nString quoted = RedisValueUtils.getRedisValue(safe);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip or reject NUL, CR, LF characters from user input before calling getRedisValue","Use a UI validator to reject control characters in key name fields","Encode binary key content as Base64 or hex instead of raw strings"],"tags":["redis","injection-guard","validation","security"],"backgroundTag":null,"analyzedSha":"5ee1e990e73fbcae1969dc554be254fedb3ab888","analyzedAt":"2026-08-14T07:05:03.077Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}