projectdiscovery/nuclei · warning

share path contains NUL

Error message

share path contains NUL

What it means

NormalizeSharePath sanitizes share-relative paths for smbsession operations (ListDir, ReadFile, ListTree). A NUL byte (U+0000) cannot travel in an SMB path and would silently truncate it, so any path containing one is rejected outright before network I/O. This is a pure input-validation error on the caller's string.

Source

Thrown at pkg/js/libs/smbsession/path.go:37

		return user[:i], user[i+1:]
	}
	if i := strings.LastIndexByte(user, '@'); i > 0 {
		return user[i+1:], user[:i]
	}
	return "", user
}

// NormalizeSharePath converts an SMB share-relative path to a clean form
// (forward slashes, no leading slash, "." for share root). Rejects ".." escapes.
func NormalizeSharePath(p string) (string, error) {
	p = strings.TrimSpace(p)
	p = strings.ReplaceAll(p, `\`, `/`)
	p = strings.Trim(p, `/`)
	if p == "" || p == "." {
		return ".", nil
	}
	if strings.ContainsRune(p, 0) {
		return "", fmt.Errorf("share path contains NUL")
	}
	clean := path.Clean(p)
	clean = strings.TrimPrefix(clean, "/")
	if clean == ".." || strings.HasPrefix(clean, "../") {
		return "", fmt.Errorf("share path escapes share root: %q", p)
	}
	if clean == "." {
		return ".", nil
	}
	return clean, nil
}

// RequireShareName validates a share name (no path separators).
func RequireShareName(share string) error {
	share = strings.TrimSpace(share)
	if share == "" {
		return fmt.Errorf("share name cannot be empty")
	}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Strip NUL bytes from the path before calling: strings.ReplaceAll(p, \"\\x00\", \"\")
2. Validate extracted paths contain only printable characters
3. Skip the entry and log instead of passing raw bytes through

Example fix

// before
path := string(rawBytes) // rawBytes ends with ...\\x00\\x00
entries, err := s.ListDir(share, path) // share path contains NUL

// after
path := strings.TrimRight(string(rawBytes), \"\\x00\")
entries, err := s.ListDir(share, path)

if strings.ContainsRune(p, 0) {
    p = strings.ReplaceAll(p, "\\x00", "")
    // or reject: return errors.New("path has NUL bytes")
}

func hasNoNUL(s string) bool { return !strings.ContainsRune(s, 0) }

normalized, err := smbsession.NormalizeSharePath(p)
if err != nil && strings.Contains(err.Error(), "contains NUL") {
    p = strings.ReplaceAll(p, "\\x00", "")
    normalized, err = smbsession.NormalizeSharePath(p)
}

When it happens

Trigger: Passing a path assembled from binary response data (e.g. bytes read off a socket) that contains \x00; template strings sourced from a mangled file listing; Deliberate injection attempts through share paths.

Common situations: Paths extracted from protocol responses without decoding/stripping control bytes; mis-encoded UTF-16 to UTF-8 conversions leaving NULs; fuzzed template variables.

Related errors

• share name must not contain path separators: %q
• no input provider found
• headless template threads must be at least 1
• share path escapes share root: %q
• share name cannot be empty

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/aeba121a998fafb6. Report an issue: GitHub.