{"record":{"id":"f82021f6c852fe80","repo":"docling-project/docling","slug":"invalid-tesseract-data-path-contains-null-byte","errorCode":null,"errorMessage":"Invalid Tesseract data path: contains null byte.","messagePattern":"Invalid Tesseract data path: contains null byte\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"docling/models/stages/ocr/tesseract_ocr_cli_model.py","lineNumber":112,"sourceCode":"        Valid identifiers (e.g. ``eng``, ``script/Latin``, ``eng+deu``) contain only\n        alphanumeric characters, underscores, hyphens, forward slashes, and plus signs.\n        \"\"\"\n        if not _VALID_LANG_RE.match(lang):\n            raise ValueError(\n                f\"Invalid Tesseract language identifier: {lang!r}. \"\n                \"Language identifiers must only contain alphanumeric characters, \"\n                \"underscores, hyphens, forward slashes, and plus signs.\"\n            )\n        return lang\n\n    @staticmethod\n    def _sanitize_path(path: str) -> str:\n        \"\"\"Validate and sanitize a Tesseract data directory path to prevent argument injection.\n\n        Rejects paths containing null bytes and resolves the path to an absolute form.\n        \"\"\"\n        if \"\\x00\" in path:\n            raise ValueError(\"Invalid Tesseract data path: contains null byte.\")\n        return str(Path(path).resolve())\n\n    @staticmethod\n    def _sanitize_cmd(cmd: str) -> str:\n        \"\"\"Validate and sanitize the Tesseract executable name/path to prevent injection.\n\n        Rejects values containing null bytes.\n        \"\"\"\n        if \"\\x00\" in cmd:\n            raise ValueError(\"Invalid Tesseract command: contains null byte.\")\n        return cmd\n\n    @staticmethod\n    def _sanitize_filename(filename: str) -> str:\n        \"\"\"Validate and sanitize a filename passed to the Tesseract CLI.\n\n        Rejects paths containing null bytes and resolves to an absolute path.\n        \"\"\"","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/docling-project/docling/blob/61d76f1ff3f8428065465889f7b4577da7df704c/docling/models/stages/ocr/tesseract_ocr_cli_model.py#L94-L130","documentation":"The Tesseract data directory path (tessdata path) is passed to the Tesseract CLI, so Docling sanitizes it and explicitly rejects any value containing a NUL byte (\\x00), which cannot be a legitimate path component and is a classic argument injection vector.","triggerScenarios":"Setting the Tesseract data path option (e.g. TesseractOcrOptions(data_path=...) or the equivalent TESSDATA path option) to a string that embeds a null byte, usually from malformed user input or binary data decoded into the config.","commonSituations":"Config values read from binary/truncated files or untrusted HTTP payloads that carry control characters; defensive rejection before the path is resolved and forwarded to the CLI.","solutions":["Remove the null byte from the data path string (strip control characters before assigning the option).","Source the path from a validated configuration system rather than raw external input.","Verify with 'print(repr(value))' that the path you pass has no \\x00 characters."],"exampleFix":"# before\nTesseractOcrOptions(data_path=\"/usr/share/tesseract-ocr/4.00/tessdata\\x00\")\n\n# after\nTesseractOcrOptions(data_path=\"/usr/share/tesseract-ocr/4.00/tessdata\")","handlingStrategy":"validation","validationCode":"def safe_data_path(path: str) -> str:\n    if \"\\x00\" in path:\n        raise ValueError(\"data path contains NUL byte\")\n    return path\n\nocr_options.data_path = safe_data_path(raw_config[\"tessdata_dir\"])","typeGuard":"def is_nul_free(s: str) -> bool:\n    return \"\\x00\" not in s","tryCatchPattern":"try:\n    ocr_options.data_path = value\nexcept ValueError as e:\n    if \"null byte\" in str(e):\n        log.warning(\"rejecting tessdata path with NUL byte\")\n        value = value.split(\"\\x00\")[0]  # only if recovery is acceptable\n    else:\n        raise","preventionTips":["Treat NUL bytes in any path as corrupt input; reject at the trust boundary.","Normalize/decode config strings with errors='strict' to surface control characters.","Run input through a control-character scrubber for externally sourced paths."],"tags":["ocr","tesseract","validation","security","injection"],"backgroundTag":null,"analyzedSha":"61d76f1ff3f8428065465889f7b4577da7df704c","analyzedAt":"2026-08-14T23:53:18.727Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}