{"record":{"id":"74d1c7872ee6aa2c","repo":"affaan-m/ECC","slug":"cwd-must-not-contain-a-nul-byte","errorCode":null,"errorMessage":"--cwd must not contain a NUL byte.","messagePattern":"--cwd must not contain a NUL byte\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"skills/terminal-opener/scripts/open-terminal.js","lineNumber":47,"sourceCode":"  --help, -h         Show this help.\n\nAlways pass the executable and arguments as separate entries after --.\nShell command strings are not accepted.\n`;\n}\n\nfunction isAbsolutePath(value) {\n  return path.isAbsolute(value) || path.win32.isAbsolute(value);\n}\n\nfunction validateTerminalName(value) {\n  if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(value)) {\n    throw new Error('Invalid terminal name; use a simple adapter name such as wezterm.');\n  }\n}\n\nfunction validateCwd(value) {\n  if (value.includes('\\0')) throw new Error('--cwd must not contain a NUL byte.');\n  if (!isAbsolutePath(value)) throw new Error('--cwd must be an absolute path.');\n}\n\nfunction validateExecutable(value) {\n  if (!value || /[\\0\\r\\n]/.test(value)) {\n    throw new Error('Executable must be a non-empty argv entry without control bytes.');\n  }\n\n  const whitespaceIndex = value.search(/\\s/);\n  const separatorIndexes = [value.indexOf('/'), value.indexOf('\\\\')].filter(index => index >= 0);\n  const firstSeparatorIndex = separatorIndexes.length > 0 ? Math.min(...separatorIndexes) : -1;\n  const resemblesExecutablePath = isAbsolutePath(value)\n    || (firstSeparatorIndex >= 0 && (whitespaceIndex < 0 || firstSeparatorIndex < whitespaceIndex));\n\n  if (whitespaceIndex >= 0 && !resemblesExecutablePath) {\n    throw new Error(\n      'Executable must be one argv entry, not an interpolated shell command string.'\n    );","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/skills/terminal-opener/scripts/open-terminal.js#L29-L65","documentation":"validateCwd rejects any --cwd value containing a NUL (\\0) byte. NUL bytes can truncate or corrupt paths at the OS boundary and are a classic injection vector. This is the first of two cwd checks (the second, at line 48, validates absoluteness). It fires during parseArgs.","triggerScenarios":"Passing --cwd with a value that includes a literal \\0 byte. parseArgs calls validateCwd before returning.","commonSituations":"Corrupted environment or argv; malicious or untrusted input forwarded into --cwd; binary garbage in a path variable.","solutions":["Sanitize the cwd string: strip NUL bytes before passing.","Source --cwd from a trusted, validated path rather than raw external input."],"exampleFix":"// before\nconst cwd = untrustedInput; // may contain \\0\nparseArgs(['--cwd', cwd, '--', 'echo']);\n\n// after\nconst cwd = untrustedInput.replace(/\\0/g, '');\nparseArgs(['--cwd', cwd, '--', 'echo']);","handlingStrategy":"validation","validationCode":"function safeCwd(value) {\n  if (typeof value !== 'string' || value.includes('\\0')) {\n    throw new Error('cwd contains a NUL byte or is not a string');\n  }\n  return value;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize any path sourced from untrusted input by stripping NUL bytes at the boundary.","Prefer path.resolve() on user input to normalize before passing as --cwd."],"tags":["validation","security","terminal","path"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}