unslothai/unsloth · error · ValueError

dataset path may not contain null bytes

Error message

dataset path may not contain null bytes

What it means

Raised by resolve_dataset_path() in the studio backend when the supplied dataset path string contains a null byte (\x00). Null bytes are rejected up-front because they cannot form a valid filesystem path and can be used to truncate or confuse path-handling code downstream. This is an input-validation ValueError that fires before any filesystem access happens.

Source

Thrown at studio/backend/utils/paths/storage_roots.py:499

    return resolve_under_root(
        path_value,
        root = exports_root(),
        strip_prefixes = ("exports",),
    )


def resolve_tensorboard_dir(path_value: str | None = None) -> Path:
    return resolve_under_root(
        path_value,
        root = tensorboard_root(),
        strip_prefixes = ("runs", "tensorboard"),
    )


def resolve_dataset_path(path_value: str) -> Path:
    raw = str(path_value or "").strip()
    if "\x00" in raw:
        raise ValueError("dataset path may not contain null bytes")
    path = Path(raw).expanduser()
    if ".." in path.parts:
        raise ValueError(f"dataset path may not contain '..' segments: {raw!r}")
    if path.is_absolute():
        for root_fn in (datasets_root, dataset_uploads_root, recipe_datasets_root):
            try:
                _assert_contained(path, root_fn())
                return path
            except ValueError:
                continue
        raise ValueError(f"dataset path must be relative or under a dataset root: {raw!r}")

    parts = [part for part in Path(path_value).parts if part not in ("", ".")]
    if parts[:2] == ["assets", "datasets"]:
        parts = parts[2:]
    if parts and parts[0] == "uploads":
        cleaned = Path(*parts[1:]) if len(parts) > 1 else Path()
        return dataset_uploads_root() / cleaned

View on GitHub (pinned to 203007d190)

Solutions

1. Sanitize or reject the input string at the API boundary before calling resolve_dataset_path (strip or refuse '\x00').
2. Inspect the caller that produced the path value (request parsing, DB column, config file) and fix the encoding/truncation bug upstream.
3. If the null byte is legitimate data noise, strip it: path_value.replace('\x00', '') before resolution — only if truncation semantics are acceptable for your app.

Example fix

// before
const p = rawBuffer.toString('utf-8'); // may contain \x00
resolve_dataset_path(p);

// after
const p = rawBuffer.toString('utf-8').replace(/\x00/g, '');
if (!p) throw new Error('empty dataset path');
resolve_dataset_path(p);

def safe_dataset_path(raw: str) -> str:
    if '\x00' in (raw or ''):
        raise ValueError('dataset path contains null bytes')
    return raw.strip()

resolve_dataset_path(safe_dataset_path(user_input))

try:
    path = resolve_dataset_path(raw)
except ValueError as e:
    if 'null bytes' in str(e):
        return bad_request('dataset path contains null bytes')  # client bug, do not retry
    raise

When it happens

Trigger: Calling resolve_dataset_path(path_value) where path_value (after str() and .strip()) contains a literal '\x00' character — e.g. a value read from a binary-polluted request body, a truncated C string, or a crafted API payload like 'data\x00.csv'.

Common situations: Malformed client input passed through an HTTP API, data copied from binary sources, or test fixtures that embed escape sequences. Also seen when a frontend sends a string that was never sanitized after decoding a byte buffer containing embedded nulls.

Related errors

• dataset path may not contain '..' segments: {raw!r}
• dataset path must be relative or under a dataset root: {raw!
• This execution artifact is outside the Recipe Studio dataset
• dataset path may not contain null bytes
• dataset path may not contain '..' segments: {raw!r}

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/38030901e8e91ad9. Report an issue: GitHub.