{"record":{"id":"3979e9e58d8ff341","repo":"ComposioHQ/composio","slug":"invalid-3979e9","errorCode":"Invalid","errorMessage":"service must not contain NUL bytes","messagePattern":"service must not contain NUL bytes","errorType":"validation","errorClass":"KeyringError","httpStatus":null,"severity":"error","filePath":"ts/packages/cli-keyring/src/stores/linux-secret-tool.ts","lineNumber":41,"sourceCode":"\nimport { existsSync } from 'node:fs';\nimport type { CredentialStore, EntryModifiers } from '../core/store';\nimport { CredentialPersistence } from '../core/persistence';\nimport { KeyringError } from '../core/errors';\nimport {\n  bytesToUtf8,\n  decodeSecret,\n  encodeSecret,\n  runCommand,\n  utf8ToBytes,\n  type SpawnResult,\n} from './shared';\n\nconst SECRET_TOOL_BIN = 'secret-tool';\n\nfunction validateSpecifier(service: string, user: string): void {\n  if (service.includes('\\0')) {\n    throw new KeyringError({\n      kind: 'Invalid',\n      param: 'service',\n      reason: 'service must not contain NUL bytes',\n    });\n  }\n  if (user.includes('\\0')) {\n    throw new KeyringError({\n      kind: 'Invalid',\n      param: 'user',\n      reason: 'user must not contain NUL bytes',\n    });\n  }\n}\n\nfunction attributeArgs(\n  service: string,\n  user: string,\n  modifiers: EntryModifiers","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/ComposioHQ/composio/blob/64b1b85502b1beeb2379e6c9e8bf1104504fa637/ts/packages/cli-keyring/src/stores/linux-secret-tool.ts#L23-L59","documentation":"The Linux secret-tool store rejects service strings containing NUL (\\0) bytes because they cannot be passed as argv attributes to the secret-tool binary. KeyringError kind 'Invalid', param 'service'.","triggerScenarios":"Calling setSecret/getSecret/deleteCredential on the Linux secret-tool store with a service string containing '\\0' (often from binary data or a truncated buffer).","commonSituations":"Concatenating buffers into strings, reading fixed-length binary fields, or fuzzed input reaching the keyring layer.","solutions":["Sanitize/validate strings before calling the store","Trace where the NUL entered the service name (buffer mishandling upstream)"],"exampleFix":"// before\nstore.setSecret(buf.toString('utf8'), user, secret);\n// after\nconst svc = buf.toString('utf8').replace(/\\0.*$/s, '');\nstore.setSecret(svc, user, secret);","handlingStrategy":"validation","validationCode":"if (service.includes('\\0')) throw new TypeError('NUL in service');","typeGuard":"const isCleanSpecifier = (s: string) => !s.includes('\\0');","tryCatchPattern":null,"preventionTips":["Never build strings from raw buffers without NUL checks"],"tags":["keyring","linux","validation","typescript"],"backgroundTag":"nul-byte-in-string","analyzedSha":"64b1b85502b1beeb2379e6c9e8bf1104504fa637","analyzedAt":"2026-08-28T15:39:33.623Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}