{"record":{"id":"aa1da2f20fc507f8","repo":"ruvnet/ruflo","slug":"null-byte-injection","errorCode":"NULL_BYTE_INJECTION","errorMessage":"Null byte detected in argument","messagePattern":"Null byte detected in argument","errorType":"exception","errorClass":"SafeExecutorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/safe-executor.ts","lineNumber":260,"sourceCode":"      throw new SafeExecutorError(\n        'Sudo commands are not allowed',\n        'SUDO_NOT_ALLOWED',\n        command\n      );\n    }\n  }\n\n  /**\n   * Validates command arguments for injection patterns.\n   *\n   * @param args - Arguments to validate\n   * @throws SafeExecutorError if arguments contain dangerous patterns\n   */\n  private validateArguments(args: string[]): void {\n    for (const arg of args) {\n      // Check for null bytes\n      if (arg.includes('\\0')) {\n        throw new SafeExecutorError(\n          'Null byte detected in argument',\n          'NULL_BYTE_INJECTION',\n          undefined,\n          args\n        );\n      }\n\n      // Check against blocked patterns\n      for (const pattern of this.blockedPatterns) {\n        if (pattern.test(arg)) {\n          throw new SafeExecutorError(\n            `Dangerous pattern detected in argument: ${arg}`,\n            'DANGEROUS_PATTERN',\n            undefined,\n            args\n          );\n        }\n      }","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/safe-executor.ts#L242-L278","documentation":"SafeExecutor.validateArguments found a NUL byte (\\0) in one of the command arguments. Null bytes can truncate or manipulated C-string based process APIs and are a classic argument-injection vector, so the whole execution is refused before spawning (shell is already disabled as defense-in-depth).","triggerScenarios":"Thrown at v3/@claude-flow/security/src/safe-executor.ts:260 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sanitize arguments to remove null bytes before passing them to the executor.","Investigate the caller: null bytes usually indicate binary data or an injection attempt that should be rejected earlier."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}