{"record":{"id":"903500018bb16cc4","repo":"Tencent/WeKnora","slug":"environment-variable-s-value-contains-null-byte","errorCode":null,"errorMessage":"environment variable '%s' value contains null bytes","messagePattern":"environment variable '(.+?)' value contains null bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/utils/security.go","lineNumber":614,"sourceCode":"\t\tfor _, pattern := range DangerousEnvVarPatterns {\n\t\t\tif pattern.MatchString(key) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' is not allowed for security reasons\", key)\n\t\t\t}\n\t\t}\n\n\t\t// Check key length\n\t\tif len(key) > 256 {\n\t\t\treturn fmt.Errorf(\"environment variable name '%s' exceeds maximum length\", SanitizeForLog(key[:50]))\n\t\t}\n\n\t\t// Check value length\n\t\tif len(value) > 4096 {\n\t\t\treturn fmt.Errorf(\"environment variable '%s' value exceeds maximum length\", key)\n\t\t}\n\n\t\t// Check for null bytes in value\n\t\tif strings.Contains(value, \"\\x00\") {\n\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains null bytes\", key)\n\t\t}\n\n\t\t// Check value for shell injection patterns\n\t\tfor _, pattern := range DangerousArgPatterns {\n\t\t\tif pattern.MatchString(value) {\n\t\t\t\treturn fmt.Errorf(\"environment variable '%s' value contains potentially dangerous pattern\", key)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// ValidateStdioConfig performs comprehensive validation of stdio configuration\n// This should be called before creating or executing any stdio-based MCP client\nfunc ValidateStdioConfig(command string, args []string, envVars map[string]string) error {\n\t// Validate command\n\tif err := ValidateStdioCommand(command); err != nil {","sourceCodeStart":596,"sourceCodeEnd":632,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/utils/security.go#L596-L632","documentation":"This error is raised by ValidateStdioEnvVars when an environment variable value set for a stdio MCP server contains a NUL byte ('\\x00'). Null bytes are illegal in environment variables at the OS level (execve envp entries are NUL-terminated) and can be used to smuggle hidden data past naive filters. The library rejects them defensively before the process is spawned.","triggerScenarios":"Calling ValidateStdioConfig (or ValidateStdioEnvVars directly) with an envVars map where any value contains '\\x00' — typically from decoding malformed binary/JSON input into a Go string.","commonSituations":"Env values read from corrupted config files, base64/hex blobs decoded incorrectly, or payloads assembled from binary buffers instead of text.","solutions":["Sanitize the env value before passing it: strip or reject any value containing '\\x00' with strings.Contains(value, \"\\x00\").","Fix the upstream decoding that produced the null byte (wrong encoding, binary file read as text).","Validate at config-load time so bad values never reach ValidateStdioConfig."],"exampleFix":"// before\nenvVars[\"MY_VAR\"] = string(rawBytes)\nerr := secutils.ValidateStdioConfig(cmd, args, envVars)\n// after\nval := strings.ReplaceAll(string(rawBytes), \"\\x00\", \"\")\nenvVars[\"MY_VAR\"] = val\nerr := secutils.ValidateStdioConfig(cmd, args, envVars)","handlingStrategy":"validation","validationCode":"func safeEnvValue(v string) bool { return !strings.Contains(v, \"\\x00\") }\nfor k, v := range envVars {\n    if !safeEnvValue(v) { return fmt.Errorf(\"env %q contains null bytes\", k) }\n}","typeGuard":"func hasNullBytes(s string) bool { return strings.ContainsRune(s, '\\x00') }","tryCatchPattern":"if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {\n    if strings.Contains(err.Error(), \"null bytes\") { /* reject config */ }\n}","preventionTips":["Decode env values as text, never from raw binary buffers.","Sanitize all externally-supplied env values at config load time.","Add a pre-flight strings.Contains check before calling the validator."],"tags":["security","validation","stdio","environment-variables"],"backgroundTag":"invalid-env-var","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}