{"id":"bfb05b779c1626fb","repo":"mongodb/node-mongodb-native","slug":"namespace-cannot-contain-a-null-character","errorCode":null,"errorMessage":"Namespace cannot contain a null character","messagePattern":"Namespace cannot contain a null character","errorType":"exception","errorClass":"MongoRuntimeError","httpStatus":null,"severity":"error","filePath":"src/cmap/commands.ts","lineNumber":103,"sourceCode":"  /** moreToCome is an OP_MSG only concept */\n  moreToCome = false;\n  databaseName: string;\n  query: Document;\n\n  constructor(databaseName: string, query: Document, options: OpQueryOptions) {\n    // Basic options needed to be passed in\n    // TODO(NODE-3483): Replace with MongoCommandError\n    const ns = `${databaseName}.$cmd`;\n    if (typeof databaseName !== 'string') {\n      throw new MongoRuntimeError('Database name must be a string for a query');\n    }\n    // TODO(NODE-3483): Replace with MongoCommandError\n    if (query == null) throw new MongoRuntimeError('A query document must be specified for query');\n\n    // Validate that we are not passing 0x00 in the collection name\n    if (ns.indexOf('\\x00') !== -1) {\n      // TODO(NODE-3483): Use MongoNamespace static method\n      throw new MongoRuntimeError('Namespace cannot contain a null character');\n    }\n\n    // Basic optionsa\n    this.databaseName = databaseName;\n    this.query = query;\n    this.ns = ns;\n\n    // Additional options\n    this.numberToSkip = options.numberToSkip || 0;\n    this.numberToReturn = options.numberToReturn || 0;\n    this.returnFieldSelector = options.returnFieldSelector || undefined;\n    this.requestId = options.requestId ?? OpQueryRequest.getRequestId();\n\n    // special case for pre-3.2 find commands, delete ASAP\n    this.pre32Limit = options.pre32Limit;\n\n    // Serialization option\n    this.serializeFunctions =","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/commands.ts#L85-L121","documentation":"Thrown by the OpQueryRequest constructor (commands.ts:103) as a MongoRuntimeError when the constructed namespace ('databaseName.$cmd') contains a null byte (\\x00). Null bytes are the BSON/C string terminator; embedding one would truncate or corrupt the wire message, so the driver rejects it defensively.","triggerScenarios":"databaseName contains a literal \\x00 character (e.g. from corrupted input, unsafe string concatenation, or a binary value coerced to string). The check runs on the composed 'db.$cmd' string.","commonSituations":"Untrusted input used to form a database name without sanitization; binary data leaking into a namespace string; log/parser code that mishandles buffers. Very rare in practice since database names from the public API go through Db/collection construction with their own validation.","solutions":["Sanitize database/collection names: strip or reject control characters including \\x00","Validate user-supplied namespace input against /^[a-zA-Z0-9_-]+$/ before use","If reading names from external data, scrub null bytes: name.replace(/\\x00/g, '')"],"exampleFix":"// before\nconst dbName = taintedInput; // may contain \\x00\n// after\nconst dbName = taintedInput.replace(/[\\x00-\\x1f]/g, '');","handlingStrategy":"validation","validationCode":"function sanitizeNamespaceName(name: string): string {\n  if (/[\\x00]/.test(name)) throw new Error('namespace contains null byte');\n  return name;\n}\nconst dbName = sanitizeNamespaceName(userInput);","typeGuard":"function isCleanNamespaceName(name: unknown): name is string {\n  return typeof name === 'string' && !/\\x00/.test(name) && /^[A-Za-z0-9_-]+$/.test(name);\n}","tryCatchPattern":null,"preventionTips":["Sanitize all user-supplied database/collection names","Reject control characters in namespace inputs","Use a strict allowlist regex for namespace tokens"],"tags":["wire-protocol","namespace","validation","sanitization"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}