{"record":{"id":"727de785781f4ec9","repo":"MemPalace/mempalace","slug":"field-name-contains-null-bytes","errorCode":null,"errorMessage":"{field_name} contains null bytes","messagePattern":"(.+?) contains null bytes","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"mempalace/config.py","lineNumber":92,"sourceCode":"    \"\"\"Validate and sanitize a wing/room/entity name.\n\n    Raises ValueError if the name is invalid.\n    \"\"\"\n    if not isinstance(value, str) or not value.strip():\n        raise ValueError(f\"{field_name} must be a non-empty string\")\n\n    value = value.strip()\n\n    if len(value) > MAX_NAME_LENGTH:\n        raise ValueError(f\"{field_name} exceeds maximum length of {MAX_NAME_LENGTH} characters\")\n\n    # Block path traversal\n    if \"..\" in value or \"/\" in value or \"\\\\\" in value:\n        raise ValueError(f\"{field_name} contains invalid path characters\")\n\n    # Block null bytes\n    if \"\\x00\" in value:\n        raise ValueError(f\"{field_name} contains null bytes\")\n\n    # Enforce safe character set\n    if not _SAFE_NAME_RE.match(value):\n        raise ValueError(f\"{field_name} contains invalid characters\")\n\n    return value\n\n\ndef sanitize_kg_value(value: str, field_name: str = \"value\") -> str:\n    \"\"\"Validate a knowledge-graph entity name (subject or object).\n\n    More permissive than sanitize_name — allows punctuation like commas,\n    colons, and parentheses that are common in natural-language KG values.\n    Only blocks null bytes and over-length strings.\n\n    Not used for wing/room names (which have filesystem constraints) or\n    predicates (which should be simple relationship identifiers).\n    \"\"\"","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/MemPalace/mempalace/blob/06cb6987f02610784fefbad4b2bd5d026d164ba6/mempalace/config.py#L74-L110","documentation":"Raised by sanitize_name() when the supplied name contains a NUL byte (\\x00). NUL bytes are invalid in filesystem paths and terminate C strings in underlying storage engines (SQLite, ChromaDB), so any name containing one is rejected before storage. This usually indicates corrupted input or binary data leaking into a text field.","triggerScenarios":"Passing a name containing \\x00 — typically from decoding binary data, truncated/corrupted UTF-8, or a test fixture embedding raw bytes.","commonSituations":"Reading names from a binary or mis-decoded source; data corrupted in transit; fuzzing/security testing payloads embedded in tool arguments.","solutions":["Strip or reject NUL bytes at the source: name.replace(\"\\x00\", \"\") if lossy cleanup is acceptable","Find where the binary data entered the pipeline (file decode mode, socket read) and fix the decoding","Treat the presence of \\x00 in a name as a bug in the upstream producer, not something to sanitize away silently"],"exampleFix":"# before\nname = raw_bytes.decode(\"utf-8\", errors=\"ignore\")   # may retain \\x00\n\n# after\nname = raw_bytes.decode(\"utf-8\", errors=\"strict\").replace(\"\\x00\", \"\")","handlingStrategy":"validation","validationCode":"# Reject binary-contaminated names before the call:\nif not isinstance(name, str) or \"\\x00\" in name:\n    raise SystemExit(\"name must be NUL-free text\")","typeGuard":"def is_nul_free(value: str) -> bool:\n    return isinstance(value, str) and \"\\x00\" not in value","tryCatchPattern":"try:\n    safe = sanitize_name(name)\nexcept ValueError as exc:\n    if \"null bytes\" in str(exc):\n        safe = sanitize_name(name.replace(\"\\x00\", \"\"))\n    else:\n        raise","preventionTips":["Decode text inputs strictly (errors='strict') at ingestion","Sniff for \\x00 to detect binary files before processing them as text","Treat NUL in a name as an upstream data-corruption signal"],"tags":["validation","binary-data","security","names","mempalace"],"backgroundTag":null,"analyzedSha":"06cb6987f02610784fefbad4b2bd5d026d164ba6","analyzedAt":"2026-08-15T03:03:36.213Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}