{"record":{"id":"3e28f5f6337e3f8c","repo":"affaan-m/ECC","slug":"arguments-must-not-contain-nul-bytes","errorCode":null,"errorMessage":"Arguments must not contain NUL bytes.","messagePattern":"Arguments must not contain NUL bytes\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"skills/terminal-opener/scripts/open-terminal.js","lineNumber":76,"sourceCode":"  const firstSeparatorIndex = separatorIndexes.length > 0 ? Math.min(...separatorIndexes) : -1;\n  const resemblesExecutablePath = isAbsolutePath(value)\n    || (firstSeparatorIndex >= 0 && (whitespaceIndex < 0 || firstSeparatorIndex < whitespaceIndex));\n\n  if (whitespaceIndex >= 0 && !resemblesExecutablePath) {\n    throw new Error(\n      'Executable must be one argv entry, not an interpolated shell command string.'\n    );\n  }\n  if (!resemblesExecutablePath && /[;&|<>`$]/.test(value)) {\n    throw new Error(\n      'Executable must be one argv entry, not an interpolated shell command string.'\n    );\n  }\n}\n\nfunction validateArgv(argv) {\n  for (const argument of argv) {\n    if (argument.includes('\\0')) throw new Error('Arguments must not contain NUL bytes.');\n  }\n}\n\nfunction readValue(argv, index, option) {\n  const value = argv[index + 1];\n  if (value === undefined || value.startsWith('--')) {\n    throw new Error(`Missing value for ${option}.`);\n  }\n  return value;\n}\n\nfunction parseArgs(argv, context = {}) {\n  const env = context.env || process.env;\n  const initialTerminal = env.ECC_TERMINAL || DEFAULT_TERMINAL;\n  const initialCwd = context.cwd || process.cwd();\n  const options = {\n    argv: [],\n    cwd: initialCwd,","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/skills/terminal-opener/scripts/open-terminal.js#L58-L94","documentation":"validateArgv iterates every argument token after the executable and rejects any containing a NUL (\\0) byte. Same rationale as the cwd and executable NUL checks: NULs can truncate argv at the OS boundary and enable injection. Called from parseArgs after validateExecutable.","triggerScenarios":"Any element of options.argv (the tokens after the executable) contains \\0. parseArgs calls validateArgv near the end of parsing.","commonSituations":"Binary or corrupted argument values; untrusted input forwarded into an argument; a fixture containing raw bytes.","solutions":["Strip NUL bytes from each argument before passing.","Validate arguments sourced from untrusted input."],"exampleFix":"// before\nconst args = rawUserArgs; // may contain \\0\nparseArgs(['--', 'echo', ...args]);\n\n// after\nconst args = rawUserArgs.map(a => a.replace(/\\0/g, ''));\nparseArgs(['--', 'echo', ...args]);","handlingStrategy":"validation","validationCode":"function sanitizeArgv(argv) {\n  return argv.map(arg => {\n    if (typeof arg !== 'string' || arg.includes('\\0')) {\n      throw new Error('Argument contains a NUL byte or is not a string');\n    }\n    return arg;\n  });\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip NUL bytes from any argument sourced from binary or untrusted input.","Validate each argv entry is a string before building the command line."],"tags":["validation","security","terminal","argv"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}