{"record":{"id":"5387c1852e779571","repo":"FlowiseAI/Flowise","slug":"invalid-path-null-bytes-or-control-characters-det","errorCode":null,"errorMessage":"Invalid path: null bytes or control characters detected","messagePattern":"Invalid path: null bytes or control characters detected","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/components/src/validator.ts","lineNumber":240,"sourceCode":"    if (!userProvidedPath || userProvidedPath.trim() === '') {\n        return path.join(getUserHome(), '.flowise', 'vectorstore')\n    }\n\n    const basePath = userProvidedPath.trim()\n\n    // Check for explicit path traversal patterns (..)\n    if (basePath.includes('..')) {\n        throw new Error('Invalid path: path traversal attempt detected')\n    }\n\n    // Check for URL-encoded path traversal\n    if (basePath.toLowerCase().includes('%2e') || basePath.toLowerCase().includes('%2f') || basePath.toLowerCase().includes('%5c')) {\n        throw new Error('Invalid path: encoded path traversal attempt detected')\n    }\n\n    // Check for null bytes and control characters\n    if (/\\0/.test(basePath) || /[\\x00-\\x1f]/.test(basePath)) {\n        throw new Error('Invalid path: null bytes or control characters detected')\n    }\n\n    // Check for Windows-specific absolute paths and UNC paths (even on Unix systems)\n    // This prevents cross-platform attack vectors\n    if (/^[a-zA-Z]:\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Windows absolute paths are not allowed')\n    }\n    if (/^\\\\\\\\[^\\\\]/.test(basePath)) {\n        throw new Error('Invalid path: UNC paths are not allowed')\n    }\n    if (/^\\\\\\\\\\?\\\\/.test(basePath)) {\n        throw new Error('Invalid path: Extended-length paths are not allowed')\n    }\n\n    // Resolve to absolute path\n    // If path is relative, resolve it relative to the .flowise directory (safe default)\n    // If path is already absolute, keep it as-is\n    let resolvedPath: string","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/FlowiseAI/Flowise/blob/abe4a8601a058047b350c260676826e21dd14101/packages/components/src/validator.ts#L222-L258","documentation":"Thrown by validateVectorStorePath (packages/components/src/validator.ts:240) when the base path contains a NUL byte (\\0) or any ASCII control character in the range 0x00-0x1f. Control characters let attackers truncate or manipulate paths at the OS layer (e.g. 'safe\\0.txt' interpreted as 'safe'); Flowise rejects them outright.","triggerScenarios":"A node config path contains a literal \\0, tab, newline, or other control char — often from binary input, copy-paste of terminal output, or a malicious payload injected via chat/API.","commonSituations":"Pasting paths from terminals/logs that include invisible chars; binding raw multipart/form-data without sanitization; test fixtures generated with random byte strings.","solutions":["Strip control characters from user input before assigning to basePath (replace /[\\x00-\\x1f]/g).","Re-type the path by hand instead of copy-pasting from an untrusted source.","Validate paths against /^[\\x20-\\x7e]+$/ at the API boundary."],"exampleFix":"// before\nnodeParams.basePath = rawInput   // contains a stray \\n or \\0\n\n// after\nnodeParams.basePath = rawInput.replace(/[\\x00-\\x1f]/g, '').trim()","handlingStrategy":"validation","validationCode":"if (/[\\x00-\\x1f]/.test(String(basePath ?? ''))) throw new Error('control characters in path');","typeGuard":"const isPrintable = (p: unknown): p is string => typeof p === 'string' && /^[\\x20-\\x7e]+$/.test(p);","tryCatchPattern":"try { validateVectorStorePath(basePath) } catch (e) { if (e instanceof Error && /control characters/.test(e.message)) { basePath = basePath.replace(/[\\x00-\\x1f]/g, '') } else throw e }","preventionTips":["Strip control characters from all path inputs at the API boundary.","Avoid copy-pasting paths from terminals/logs; re-type them.","Constrain path inputs to printable ASCII with a regex."],"tags":["path-traversal","security","validation","sanitization","vector-store","flowise"],"backgroundTag":null,"analyzedSha":"abe4a8601a058047b350c260676826e21dd14101","analyzedAt":"2026-08-12T16:04:40.823Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}