ruvnet/ruflo · error · Error

${label} contains null bytes

Error message

${label} contains null bytes

What it means

Thrown by the internal validatePath() function in daemon.ts when a path argument contains a null byte (\0). Null bytes are a classic injection vector — they can truncate strings in C-based path APIs and bypass security filters that check suffixes or prefixes. This is a defence-in-depth security check before the path is used in child-process argv or ps/tasklist comparisons.

Source

Thrown at v3/@claude-flow/cli/src/commands/daemon.ts:372

      return { success: true };
    } catch (error) {
      output.printError(`Failed to start daemon: ${error instanceof Error ? error.message : String(error)}`);
      return { success: false, exitCode: 1 };
    }
  },
};

/**
 * Validate path for security - prevents path traversal and injection
 */
function validatePath(path: string, label: string): void {
  // Must be absolute after resolution
  const resolved = resolve(path);

  // Check for null bytes (injection attack)
  if (path.includes('\0')) {
    throw new Error(`${label} contains null bytes`);
  }

  // Check for shell metacharacters in path components
  if (/[;&|`$<>]/.test(path)) {
    throw new Error(`${label} contains shell metacharacters`);
  }

  // Prevent path traversal outside expected directories
  if (!resolved.includes('.claude-flow') && !resolved.includes('bin')) {
    // Allow only paths within project structure
    const cwd = process.cwd();
    if (!resolved.startsWith(cwd)) {
      throw new Error(`${label} escapes project directory`);
    }
  }
}

/**

View on GitHub (pinned to 6b01dc5a68)

Solutions

1. Remove all null bytes from the path string before passing it to the daemon
2. Sanitize input at the system boundary: strip or reject '\0' characters
3. If the path comes from a file or environment variable, validate it does not contain null bytes before use

Example fix

// before
const workspace = getUserInput(); // "proj\0.evil"
validatePath(workspace, 'workspace');

// after
const workspace = getUserInput().replace(/\0/g, '');
validatePath(workspace, 'workspace');

function isSafePath(path: string): boolean {
  return !path.includes('\0');
}

if (!isSafePath(userPath)) {
  throw new Error('Path contains null bytes');
}

function isNullByteFree(s: string): boolean {
  return !s.includes('\0');
}

try {
  validatePath(userPath, 'workspace');
} catch (e) {
  if (e instanceof Error && e.message.includes('null bytes')) {
    userPath = userPath.replace(/\0/g, '');
    // Retry with sanitized path
  }
}

When it happens

Trigger: Any call path that routes through validatePath() with a string containing the literal null character '\0'. This includes daemon workspace paths, bin paths, or any label-path pair passed to the validator.

Common situations: A malicious or corrupted input contains an embedded null byte; a binary file was accidentally read as a path string; a test fixture included a null byte that leaked into a path argument.

Related errors

• ${label} contains shell metacharacters
• ${label} escapes project directory
• Key contains disallowed characters
• Namespace contains disallowed characters
• basePath contains disallowed characters

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/52c21d6d035c7aad. Report an issue: GitHub.