{"record":{"id":"28f5f1efc7b169d8","repo":"Hmbown/CodeWhale","slug":"bundle-path-contains-a-nul-byte-refused","errorCode":null,"errorMessage":"bundle path contains a NUL byte; refused","messagePattern":"bundle path contains a NUL byte; refused","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cli/src/config_bundles.rs","lineNumber":714,"sourceCode":"\n// ---------------------------------------------------------------------------\n// Path safety\n// ---------------------------------------------------------------------------\n\n/// Resolve `candidate` inside `base_dir`, refusing traversal and symlink\n/// escapes. Returns the resolved path or an error naming the refusal — the\n/// candidate string itself is safe to echo (it is config data, not a secret).\n/// Resolve `candidate` inside `base_dir`, refusing traversal and symlink\n/// escapes. Returns the joined path or an error naming the refusal.\n/// Reserved for path-carrying bundle sections (none shipped yet); exercised\n/// by the traversal tests so the contract cannot silently rot.\n#[cfg_attr(\n    not(test),\n    expect(dead_code, reason = \"path-carrying sections land with the next schema\")\n)]\npub fn resolve_bounded_path(base_dir: &Path, candidate: &str) -> Result<PathBuf> {\n    if candidate.contains('\\0') {\n        bail!(\"bundle path contains a NUL byte; refused\");\n    }\n    let candidate_path = Path::new(candidate);\n    if candidate_path.is_absolute() {\n        bail!(\n            \"bundle path {candidate:?} is absolute; only paths inside the config directory are accepted\"\n        );\n    }\n    let canonical_base = base_dir\n        .canonicalize()\n        .with_context(|| format!(\"config directory {} is unavailable\", base_dir.display()))?;\n    let joined = base_dir.join(candidate_path);\n    // Walk the joined path's ancestors from the deepest existing component up:\n    // every existing component must canonicalize inside the base, so a symlink\n    // pointing outside the config directory is refused even when the final\n    // target does not exist yet.\n    let deepest_existing = joined\n        .ancestors()\n        .find(|ancestor| ancestor.symlink_metadata().is_ok())","sourceCodeStart":696,"sourceCodeEnd":732,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/cli/src/config_bundles.rs#L696-L732","documentation":"A path embedded in a config bundle contains a NUL byte (`\\0`). NUL bytes are illegal in filesystem paths and are a common smuggling technique, so `resolve_bounded_path` rejects them up front before any filesystem work. This is a hard security/validity guard in the bounded-path resolver of crates/cli/src/config_bundles.rs.","triggerScenarios":"Importing a bundle whose path entries (sections referencing files) contain a string with an embedded `\\0`, passed to `resolve_bounded_path`.","commonSituations":"A hand-crafted or tampered bundle; a bundle generator writing raw bytes from binary input; testing the guard directly (the cited caller is the guard test).","solutions":["Remove or fix the offending path entry in the bundle so it contains no NUL bytes.","Re-export the bundle from a trusted source with the current CLI.","If generating bundles programmatically, validate/sanitize path strings (reject `\\0`) before writing them into the bundle."],"exampleFix":"// before\n\"path\": \"settings\\0.json\"\n// after\n\"path\": \"settings.json\"","handlingStrategy":"validation","validationCode":"fn candidate_path_ok(candidate: &str) -> bool {\n    !candidate.contains('\\0')\n}","typeGuard":"fn is_nul_free(candidate: &str) -> bool {\n    !candidate.as_bytes().contains(&b'\\0')\n}","tryCatchPattern":"// wrap bounded resolution when applying bundle sections\nmatch codewhale_cli::config_bundles::resolve_bounded_path(&base_dir, candidate) {\n    Ok(path) => apply(path),\n    Err(e) if e.to_string().contains(\"NUL byte\") => log::warn!(\"skipped bundle entry with NUL-byte path: {candidate:?}\"),\n    Err(e) => return Err(e),\n}","preventionTips":["Sanitize any string that becomes a path before embedding it in a bundle.","Treat bundle files as untrusted input; validate path entries on ingest.","Never build path strings from raw binary or network bytes without validation."],"tags":["path-validation","security","config-bundle"],"backgroundTag":"path-traversal-blocked","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-22T10:30:35.592Z"}