projectdiscovery/nuclei · warning

share name contains NUL

Error message

share name contains NUL

What it means

The final RequireShareName check: a share name containing a NUL byte is rejected before any network I/O. NUL cannot appear in a valid SMB share name and would truncate the name mid-flight, so it is treated as malformed input (often binary contamination, like the path variant).

Source

Thrown at pkg/js/libs/smbsession/path.go:60

		return "", fmt.Errorf("share path escapes share root: %q", p)
	}
	if clean == "." {
		return ".", nil
	}
	return clean, nil
}

// RequireShareName validates a share name (no path separators).
func RequireShareName(share string) error {
	share = strings.TrimSpace(share)
	if share == "" {
		return fmt.Errorf("share name cannot be empty")
	}
	if strings.ContainsAny(share, `/\`) {
		return fmt.Errorf("share name must not contain path separators: %q", share)
	}
	if strings.ContainsRune(share, 0) {
		return fmt.Errorf("share name contains NUL")
	}
	return nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Trim NUL bytes from decoded strings: strings.ReplaceAll(name, \"\\x00\", \"\")
2. Decode share enumerations with proper UTF-16 handling
3. Reject non-printable share names when the value comes from untrusted input

Example fix

// before
share := string(utf16Bytes) // trailing \\x00 from UTF-16 decode
s.ListDir(share, '.') // share name contains NUL

// after
share := strings.TrimRight(string(utf16Bytes), \"\\x00\")
s.ListDir(share, '.')

share = strings.ReplaceAll(share, "\\x00", "")
if share == "" { return errors.New("share name empty after sanitize") }

func hasNoNUL(s string) bool { return !strings.ContainsRune(s, 0) }

if err := smbsession.RequireShareName(share); err != nil && strings.Contains(err.Error(), "contains NUL") {
    share = strings.ReplaceAll(share, "\\x00", "")
    // retry once with sanitized name
}

When it happens

Trigger: Share names taken from raw byte buffers (share enumeration output, binary config blobs) that carry \x00; mis-decoded UTF-16 share lists that keep NUL bytes.

Common situations: Parsing NetShareEnum-style responses manually; fuzzed or hostile template variables used as the share argument.

Related errors

• no input provider found
• share path contains NUL
• share path escapes share root: %q
• share name cannot be empty
• share name must not contain path separators: %q

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/4eddc15a3ad4dd99. Report an issue: GitHub.