{"record":{"id":"dd5313907ab7af7f","repo":"astrid-runtime/astrid","slug":"clone-source-path-has-nul","errorCode":null,"errorMessage":"clone source path has NUL","messagePattern":"clone source path has NUL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-vfs/src/workspace_cow/apfs.rs","lineNumber":226,"sourceCode":"}\n\n/// A short, deterministic hex digest of a path, used only as a directory name.\nfn path_hash(path: &Path) -> String {\n    use std::collections::hash_map::DefaultHasher;\n    use std::hash::{Hash, Hasher};\n    // Canonicalize when possible so the same workspace maps to the same digest\n    // regardless of how it was addressed; fall back to the raw path otherwise.\n    let key = std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf());\n    let mut hasher = DefaultHasher::new();\n    key.hash(&mut hasher);\n    format!(\"{:016x}\", hasher.finish())\n}\n\n/// `clonefile(src, dst, 0)` — copy-on-write clone of a whole directory tree.\n/// `dst` must not already exist.\nfn clonefile(src: &Path, dst: &Path) -> io::Result<()> {\n    let src_c = CString::new(src.as_os_str().as_bytes())\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"clone source path has NUL\"))?;\n    let dst_c = CString::new(dst.as_os_str().as_bytes())\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"clone dest path has NUL\"))?;\n    // SAFETY: `src_c`/`dst_c` are valid, NUL-terminated C strings that outlive\n    // the call; `clonefile` reads them and returns a status code, retaining no\n    // pointers. Flag `0` = default (clone contents, don't follow the final\n    // symlink).\n    let rc = unsafe { libc::clonefile(src_c.as_ptr(), dst_c.as_ptr(), 0) };\n    if rc != 0 {\n        return Err(io::Error::last_os_error());\n    }\n    Ok(())\n}\n\n/// `renamex_np(a, b, RENAME_SWAP)` — atomically swap two existing paths on the\n/// same volume.\nfn renamex_swap(a: &Path, b: &Path) -> io::Result<()> {\n    let a_c = CString::new(a.as_os_str().as_bytes())\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"swap path a has NUL\"))?;","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-vfs/src/workspace_cow/apfs.rs#L208-L244","documentation":"clonefile wraps the macOS clonefile(2) syscall and must convert Rust Paths to NUL-terminated C strings via CString::new. If the source path contains an interior NUL byte, CString::new fails and the library raises InvalidInput with this message. Such paths cannot be passed to any C API.","triggerScenarios":"Calling prepare/promote/rollback with a workspace source path that contains a 0x00 byte, typically from untrusted or corrupted input assembled into a PathBuf.","commonSituations":"Deserializing paths from JSON/config where escaped \\u0000 slipped through; corrupted database/config values; paths built by concatenating untrusted strings; binary data mistakenly treated as path text.","solutions":["Sanitize/validate workspace paths before calling CoW operations: reject any path containing a NUL byte","Fix the upstream producer that embedded NUL into the path string","Use Path::to_str() and check !contains('\\0') as an early guard","Log the offending raw path bytes to find the corruption source"],"exampleFix":"// before\nclonefile(&src, &dst)?;\n// after: validate first\nlet s = src.to_str().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, \"non-UTF8 path\"))?;\nassert!(!s.contains('\\0'), \"path contains NUL\");\nclonefile(&src, &dst)?;","handlingStrategy":"validation","validationCode":"fn ensure_no_nul(p: &Path) -> io::Result<()> {\n    if p.as_os_str().as_bytes().contains(&0) {\n        Err(io::Error::new(io::ErrorKind::InvalidInput, \"path contains NUL\"))\n    } else { Ok(()) }\n}","typeGuard":"fn is_c_string_safe(p: &Path) -> bool {\n    !p.as_os_str().as_bytes().contains(&0)\n}","tryCatchPattern":"match clonefile(&src, &dst) {\n    Err(e) if e.kind() == io::ErrorKind::InvalidInput && e.to_string().contains(\"NUL\") => {\n        log::error!(\"rejecting corrupted path: {:?}\", src.as_os_str().as_bytes());\n        sanitize_and_retry()\n    }\n    other => other,\n}","preventionTips":["Sanitize all paths at trust boundaries (user input, config, IPC)","Reject NUL bytes during deserialization of path-like fields","Store paths as validated types in your domain model","Log raw path bytes when validation fails to trace the source"],"tags":["macos","apfs","path","ffi"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}