{"record":{"id":"8c341baafe70e6b1","repo":"SonarSource/sonarqube","slug":"request-parameters-are-not-allowed-to-contain-nul","errorCode":null,"errorMessage":"Request parameters are not allowed to contain NUL character","messagePattern":"Request parameters are not allowed to contain NUL character","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sonar-plugin-api-impl/src/main/java/org/sonar/api/impl/ws/ValidatingRequest.java","lineNumber":157,"sourceCode":"  @Override\n  public <E extends Enum<E>> List<E> paramAsEnums(String key, Class<E> enumClass) {\n    List<String> values = paramAsStrings(key);\n    if (values == null) {\n      return null;\n    }\n    return values.stream()\n      .filter(s -> !s.isEmpty())\n      .map(value -> Enum.valueOf(enumClass, value))\n      .toList();\n  }\n\n  @CheckForNull\n  private String readParam(String key, @Nullable WebService.Param definition) {\n    checkArgument(definition != null, \"BUG - parameter '%s' is undefined for action '%s'\", key, action.key());\n    String deprecatedKey = definition.deprecatedKey();\n    String param = deprecatedKey != null ? Objects.toString(readParam(deprecatedKey), readParam(key)) : readParam(key);\n    if (param != null && param.contains(\"\\0\")) {\n      throw new IllegalArgumentException(\"Request parameters are not allowed to contain NUL character\");\n    }\n    return param;\n  }\n\n  private List<String> readMultiParamOrDefaultValue(String key, @Nullable WebService.Param definition) {\n    checkArgument(definition != null, \"BUG - parameter '%s' is undefined for action '%s'\", key, action.key());\n\n    List<String> keyValues = readMultiParam(key);\n    if (!keyValues.isEmpty()) {\n      return keyValues;\n    }\n\n    String deprecatedKey = definition.deprecatedKey();\n    List<String> deprecatedKeyValues = deprecatedKey == null ? emptyList() : readMultiParam(deprecatedKey);\n    if (!deprecatedKeyValues.isEmpty()) {\n      return deprecatedKeyValues;\n    }\n","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-plugin-api-impl/src/main/java/org/sonar/api/impl/ws/ValidatingRequest.java#L139-L175","documentation":"readParam rejects any request parameter value containing a NUL (\\0) character. NUL bytes in HTTP parameters are a classic request-smuggling / injection vector and break downstream string handling, so the library throws IllegalArgumentException defensively.","triggerScenarios":"Calling request.value(key) or request.rawValue(key) (which call readParam) when the incoming HTTP request supplies a parameter value containing a NUL byte, e.g. crafted URLs like %00 or malformed clients.","commonSituations":"Malicious or broken HTTP clients sending %00 in query parameters; legacy tooling that appends NUL bytes when building URLs; security scans probing for injection.","solutions":["Reject or sanitize the offending client request before it reaches the web service (validate parameter values at the edge).","Decode/inspect the raw query string to find which parameter contains %00 and fix the client producing it.","If needed for testing, remove the NUL character from the parameter value in the test request."],"exampleFix":"// before\nString value = \"foo\\0bar\";\nrequest.value(\"key\", value);\n\n// after\nString value = sanitize(\"foo\\0bar\"); // e.g. value.replace(\"\\0\", \"\")\nrequest.value(\"key\", value);","handlingStrategy":"validation","validationCode":"// client-side / edge check\nif (value.indexOf('\\0') >= 0) {\n  throw new IllegalArgumentException(\"Parameter contains NUL character: \" + key);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sanitize or reject %00 sequences in incoming URLs at a gateway/proxy.","Never build URLs from raw binary data; URL-encode parameter values.","Treat NUL-containing requests as suspicious (potential injection probing) and log them."],"tags":["webservice","security","input-validation","sonarqube-plugin"],"backgroundTag":"invalid-argument-value","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}