{"record":{"id":"262e294947d1c454","repo":"ruvnet/ruflo","slug":"event-log-path-contains-null-bytes","errorCode":null,"errorMessage":"Event log path contains null bytes","messagePattern":"Event log path contains null bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/shared/src/events/rvf-event-log.ts","lineNumber":28,"sourceCode":" *   Record:       4 bytes (uint32 BE payload length) + N bytes (JSON payload)\n *\n * In-memory indexes are rebuilt on initialize() by replaying the file.\n * Snapshots are stored in a separate `.snap.rvf` file using the same format.\n *\n * @module v3/shared/events/rvf-event-log\n */\n\nimport { EventEmitter } from 'node:events';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, renameSync } from 'node:fs';\nimport { dirname } from 'node:path';\nimport type { DomainEvent } from './domain-events.js';\n\n// Re-export shared interfaces so consumers do not need to import event-store.ts\nimport type { EventFilter, EventSnapshot, EventStoreStats } from './event-store.js';\n\n/** Validate a file path is safe */\nfunction validatePath(p: string): void {\n  if (p.includes('\\0')) throw new Error('Event log path contains null bytes');\n}\n\n// =============================================================================\n// Configuration\n// =============================================================================\n\nexport interface RvfEventLogConfig {\n  /** Path to event log file */\n  logPath: string;\n  /** Enable verbose logging */\n  verbose?: boolean;\n  /** Maximum events before snapshot recommendation */\n  snapshotThreshold?: number;\n}\n\nconst DEFAULT_CONFIG: Required<RvfEventLogConfig> = {\n  logPath: 'events.rvf',\n  verbose: false,","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/shared/src/events/rvf-event-log.ts#L10-L46","documentation":"validatePath() rejects any event-log path containing a NUL byte before it reaches Node's fs APIs. Paths with embedded NULs are invalid on Linux/macOS (ERR_INVALID_ARG_VALUE) and are also a classic path-injection vector, so RvfEventLog construction/initialization fails fast with this message. The offending value almost always originates from user input, config files, or environment variables.","triggerScenarios":"Passing a logPath built from env vars or CLI input containing a NUL byte; strings decoded from fixed-length buffers padded with NULs and not trimmed; template concatenation that pulls binary data into a path.","commonSituations":"Reading paths from IPC messages or C-style buffers sliced mid-string; config values pasted with invisible control characters; mis-decoded multibyte input producing NUL padding.","solutions":["Strip NULs at the source: logPath.replace(/\\0/g, '') — but prefer fixing the upstream producer","Decode buffers on their exact byte range (buf.toString('utf8', start, end)) instead of converting NUL-padded buffers wholesale","Validate externally supplied paths with the same includes('\\0') check before constructing RvfEventLog"],"exampleFix":"// before\nconst logPath = buf.toString(); // may contain NUL padding\nconst log = new RvfEventLog({ logPath }); // throws\n\n// after\nconst logPath = buf.subarray(0, buf.indexOf(0)).toString('utf8');\nconst log = new RvfEventLog({ logPath });","handlingStrategy":"validation","validationCode":"function safeLogPath(p: string): string {\n  if (p.includes('\\0')) throw new Error('log path contains NUL bytes');\n  return p;\n}\nconst log = new RvfEventLog({ logPath: safeLogPath(fromEnv) });","typeGuard":"function isValidPath(p: unknown): p is string {\n  return typeof p === 'string' && p.length > 0 && !p.includes('\\0');\n}","tryCatchPattern":null,"preventionTips":["Never build paths from raw buffers; decode the exact byte range up to the first NUL","Validate external path input (env vars, CLI args, config) for NUL bytes before use","Watch for invisible control characters when copy-pasting config values"],"tags":["path-validation","filesystem","security","event-log"],"backgroundTag":"invalid-path","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}