{"record":{"id":"4eddc15a3ad4dd99","repo":"projectdiscovery/nuclei","slug":"share-name-contains-nul","errorCode":null,"errorMessage":"share name contains NUL","messagePattern":"share name contains NUL","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/js/libs/smbsession/path.go","lineNumber":60,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"share path escapes share root: %q\", p)\n\t}\n\tif clean == \".\" {\n\t\treturn \".\", nil\n\t}\n\treturn clean, nil\n}\n\n// RequireShareName validates a share name (no path separators).\nfunc RequireShareName(share string) error {\n\tshare = strings.TrimSpace(share)\n\tif share == \"\" {\n\t\treturn fmt.Errorf(\"share name cannot be empty\")\n\t}\n\tif strings.ContainsAny(share, `/\\`) {\n\t\treturn fmt.Errorf(\"share name must not contain path separators: %q\", share)\n\t}\n\tif strings.ContainsRune(share, 0) {\n\t\treturn fmt.Errorf(\"share name contains NUL\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":42,"sourceCodeEnd":64,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/smbsession/path.go#L42-L64","documentation":"The final RequireShareName check: a share name containing a NUL byte is rejected before any network I/O. NUL cannot appear in a valid SMB share name and would truncate the name mid-flight, so it is treated as malformed input (often binary contamination, like the path variant).","triggerScenarios":"Share names taken from raw byte buffers (share enumeration output, binary config blobs) that carry \\x00; mis-decoded UTF-16 share lists that keep NUL bytes.","commonSituations":"Parsing NetShareEnum-style responses manually; fuzzed or hostile template variables used as the share argument.","solutions":["Trim NUL bytes from decoded strings: strings.ReplaceAll(name, \\\"\\\\x00\\\", \\\"\\\")","Decode share enumerations with proper UTF-16 handling","Reject non-printable share names when the value comes from untrusted input"],"exampleFix":"// before\nshare := string(utf16Bytes) // trailing \\\\x00 from UTF-16 decode\ns.ListDir(share, '.') // share name contains NUL\n\n// after\nshare := strings.TrimRight(string(utf16Bytes), \\\"\\\\x00\\\")\ns.ListDir(share, '.')","handlingStrategy":"validation","validationCode":"share = strings.ReplaceAll(share, \"\\\\x00\", \"\")\nif share == \"\" { return errors.New(\"share name empty after sanitize\") }","typeGuard":"func hasNoNUL(s string) bool { return !strings.ContainsRune(s, 0) }","tryCatchPattern":"if err := smbsession.RequireShareName(share); err != nil && strings.Contains(err.Error(), \"contains NUL\") {\n    share = strings.ReplaceAll(share, \"\\\\x00\", \"\")\n    // retry once with sanitized name\n}","preventionTips":["Decode Windows strings with correct UTF-16 handling to avoid stray NULs","Sanitize share names from binary enumerations before use","Reject non-printable characters in share-name inputs"],"tags":["validation","input","smb","encoding"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}