{"record":{"id":"8958553312641461","repo":"Tencent/WeKnora","slug":"argument-d-contains-null-bytes","errorCode":null,"errorMessage":"argument %d contains null bytes","messagePattern":"argument (.+?) contains null bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":580,"sourceCode":"\t\treturn nil\n\t}\n\n\tfor i, arg := range args {\n\t\t// Check length\n\t\tif len(arg) > 1024 {\n\t\t\treturn fmt.Errorf(\"argument %d exceeds maximum length (1024 characters)\", i)\n\t\t}\n\n\t\t// Check against dangerous patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(arg) {\n\t\t\t\treturn fmt.Errorf(\"argument %d contains potentially dangerous pattern: %s\", i, SanitizeForLog(arg))\n\t\t\t}\n\t\t}\n\n\t\t// Check for null bytes\n\t\tif strings.Contains(arg, \"\\x00\") {\n\t\t\treturn fmt.Errorf(\"argument %d contains null bytes\", i)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// ValidateStdioEnvVars validates environment variables for MCP stdio transport\n// Returns an error if any env var name or value is dangerous\nfunc ValidateStdioEnvVars(envVars map[string]string) error {\n\tif len(envVars) == 0 {\n\t\treturn nil\n\t}\n\n\tfor key, value := range envVars {\n\t\t// Check key against dangerous patterns\n\t\tfor _, pattern := range DangerousEnvVarPatterns {\n\t\t\tif pattern.MatchString(key) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' is not allowed for security reasons\", key)","sourceCodeStart":562,"sourceCodeEnd":598,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L562-L598","documentation":"ValidateStdioArgs rejects arguments containing NUL bytes (\\x00). Null bytes can truncate C-string handling in spawned processes and are a classic injection/evasion vector, so any argument containing one is rejected.","triggerScenarios":"An args element contains an embedded NUL byte — typically from binary data, improperly decoded buffers, or corrupted input passed as a string.","commonSituations":"Passing binary payloads or buffer slices converted to strings; reading user uploads as raw bytes into an arg; encoding bugs (UTF-16 converted naively producing \\x00 between chars).","solutions":["Strip NUL bytes from the input: strings.ReplaceAll(arg, \"\\x00\", \"\") or reject the input upstream","If binary data must be passed, encode it (base64/hex) and decode inside the target program","Fix the encoding path that produced the NUL bytes (e.g. UTF-16LE to UTF-8 conversion)"],"exampleFix":"// before\narg := string(rawBytes) // may contain \\x00\n// after\narg := base64.StdEncoding.EncodeToString(rawBytes) // pass encoded, decode in target","handlingStrategy":"validation","validationCode":"for i, a := range cfg.Args {\n    if strings.Contains(a, \"\\x00\") {\n        return fmt.Errorf(\"args[%d] contains null bytes\", i)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := ValidateStdioConfig(cfg); err != nil {\n    if strings.Contains(err.Error(), \"null bytes\") {\n        return fmt.Errorf(\"encode binary args (e.g. base64) before passing: %w\", err)\n    }\n    return err\n}","preventionTips":["Never pass raw binary data as string arguments; base64-encode it","Verify encoding conversions (UTF-16 to UTF-8) do not introduce NUL bytes","Sanitize any input derived from raw byte buffers"],"tags":["security","validation","mcp","stdio","null-bytes"],"backgroundTag":"null-byte-injection","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}