{"record":{"id":"ef95caa1cf65dcba","repo":"hashicorp/nomad","slug":"task-name-cannot-include-null-characters","errorCode":null,"errorMessage":"Task name cannot include null characters","messagePattern":"Task name cannot include null characters","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":8244,"sourceCode":"\n// Validate is used to check a task for reasonable configuration\nfunc (t *Task) Validate(jobType string, tg *TaskGroup) error {\n\tvar mErr multierror.Error\n\tif t.Name == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Missing task name\"))\n\t}\n\n\t// Tasks cannot be named \"alloc\" as this conflicts with and breaks task\n\t// filesystem isolation features.\n\tif t.Name == \"alloc\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Task cannot be named \\\"alloc\\\"\"))\n\t}\n\tif strings.ContainsAny(t.Name, `/\\`) {\n\t\t// We enforce this so that when creating the directory on disk it will\n\t\t// not have any slashes.\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Task name cannot include slashes\"))\n\t} else if strings.Contains(t.Name, \"\\000\") {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Task name cannot include null characters\"))\n\t}\n\tif t.Driver == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"Missing task driver\"))\n\t}\n\tif t.KillTimeout < 0 {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"KillTimeout must be a positive value\"))\n\t} else {\n\t\t// Validate the group's update strategy does not conflict with the\n\t\t// task's kill_timeout for service jobs.\n\t\t//\n\t\t// progress_deadline = 0 has a special meaning so it should not be\n\t\t// validated against the task's kill_timeout.\n\t\tconflictsWithProgressDeadline := jobType == JobTypeService &&\n\t\t\ttg.Update != nil &&\n\t\t\ttg.Update.ProgressDeadline > 0 &&\n\t\t\tt.KillTimeout > tg.Update.ProgressDeadline\n\t\tif conflictsWithProgressDeadline {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"KillTimout (%s) longer than the group's ProgressDeadline (%s)\",","sourceCodeStart":8226,"sourceCodeEnd":8262,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L8226-L8262","documentation":"Task.Validate rejects task names containing the null character \"\\000\". Null bytes are invalid in filesystem paths and would break allocation directory creation. This branch is only evaluated when the name contains no slashes.","triggerScenarios":"A task name containing a literal NUL character, typically from binary/corrupted input or unsanitized programmatic construction of structs.Task.","commonSituations":"Jobs built programmatically from external data where names were not sanitized; corrupt JSON payloads.","solutions":["Strip null bytes from the task name before building the job.","Sanitize any external input feeding task names.","Validate before submit."],"exampleFix":"// before\nname := strings.Replace(raw, \"\\x00\", \"\", -1) // never done\ntask.Name = raw\n// after\ntask.Name = strings.ReplaceAll(raw, \"\\x00\", \"\")","handlingStrategy":"validation","validationCode":"if strings.Contains(t.Name, \"\\x00\") {\n  return errors.New(\"task name contains null characters\")\n}","typeGuard":"func hasNoNullBytes(s string) bool {\n  return !strings.ContainsRune(s, '\\x00')\n}","tryCatchPattern":null,"preventionTips":["Sanitize all external input feeding task names.","Reject control characters in job-generation code.","Log and reject suspicious names instead of passing them through."],"tags":["nomad","task","naming","validation"],"backgroundTag":"invalid-task-name","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}