Skip to content

fix(relay): reject events containing NUL characters at validation time - #3202

Open
rvaccone wants to merge 1 commit into
block:mainfrom
rvaccone:fix/reject-nul-bytes-at-ingest
Open

rvaccone wants to merge 1 commit into
block:mainfrom
rvaccone:fix/reject-nul-bytes-at-ingest

Conversation

@rvaccone

Copy link
Copy Markdown

Events with \u0000 in content or a tag value pass signature verification, then
fail at Postgres insert with invalid byte sequence for encoding "UTF8": 0x00,
surfacing as a 500. Postgres text and jsonb cannot contain the NUL character.
Fixes #3116.

ingest_event_inner now rejects NUL in content or any tag element, next to the
content size check. Both transports route through it. id, pubkey, and sig
are hex and cannot carry NUL; profiles (kind 0) and workflow definitions
(kind 30620) are ordinary events, so the paths named in the issue are covered.

Verified live: 500 before, 400 invalid: content contains a NUL character or
invalid: tag value contains a NUL character after, no row written, clean
events unaffected. Four unit tests added; fmt and clippy pass. The 9 failing
buzz-relay --lib tests also fail at the merge base (noted as preexisting
in #3128).

Postgres cannot store NUL in text/jsonb columns, so an event carrying
\u0000 in its content or a tag value passed validation and then failed
at insert time, surfacing as a 500 internal error instead of a clean
invalid: rejection.

Fixes block#3116

Signed-off-by: Rocco Vaccone <rocco@vaccone.us>
@rvaccone
rvaccone force-pushed the fix/reject-nul-bytes-at-ingest branch from 8dfef30 to 9befca9 Compare August 30, 2026 03:29
@github-actions

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is eed74bde2f4797714335ac10c56c0b0244c1def4...9befca987c96c0cef48aad66d8aa7de9fd3849ba.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 9befca987c96c0cef48aad66d8aa7de9fd3849ba to authorize a new review.
Any previous review applies only to its recorded range.

@rvaccone

rvaccone commented Sep 9, 2026

Copy link
Copy Markdown
Author

Bump on this one. Open since July 27 with no review, and CI hasn't run yet because the workflows are still waiting on maintainer approval (fork PR).

Could someone approve the run and take a look? One file, +56 lines, fixes #3116, which is still open and still 500s on any event with an embedded NUL.

Happy to rebase onto current main if that helps.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

relay: events with embedded NUL (\u0000) reach Postgres and fail with UTF8 0x00 internal error instead of clean rejection

1 participant