{"record":{"id":"3045999f01010cbd","repo":"ruvnet/ruflo","slug":"cache-path-contains-null-bytes","errorCode":null,"errorMessage":"Cache path contains null bytes","messagePattern":"Cache path contains null bytes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/embeddings/src/rvf-embedding-cache.ts","lineNumber":25,"sourceCode":" * Features:\n * - Map-based in-memory cache with periodic flush to binary file\n * - LRU eviction tracked via access timestamps\n * - TTL support for cache entries\n * - Deterministic FNV-1a text hashing for keys\n * - Binary format: RVEC magic + entry records\n *\n * Binary entry format:\n *   [4-byte key-hash][4-byte dims][dims*4 bytes float32][8-byte timestamp][8-byte access-count]\n *\n * @module @claude-flow/embeddings\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from 'fs';\nimport { dirname } from 'path';\n\n/** Validate a file path is safe */\nfunction validatePath(p: string): void {\n  if (p.includes('\\0')) throw new Error('Cache path contains null bytes');\n}\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Configuration for RVF embedding cache\n */\nexport interface RvfEmbeddingCacheConfig {\n  /** Path to the binary cache file */\n  cachePath: string;\n  /** Maximum number of entries (default: 10000) */\n  maxSize?: number;\n  /** TTL in milliseconds (default: 7 days) */\n  ttlMs?: number;\n  /** Embedding dimensions (used for validation) */\n  dimensions?: number;","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/embeddings/src/rvf-embedding-cache.ts#L7-L43","documentation":"Path-validation guard in the RVF embedding cache: the configured cachePath contains null (0x00) bytes, which cannot be a valid filesystem path and can be used to smuggle truncation attacks past path checks. Rejected before any fs call touches the path; the constructor invokes this validator when wiring the persistent cache.","triggerScenarios":"Thrown at v3/@claude-flow/embeddings/src/rvf-embedding-cache.ts:25 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove null bytes from the cache path; build paths from validated config values.","Reject or sanitize the path before constructing the cache."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}