From 9a9cf6ae83e99fcd383bf895519b9c5c980bb95d Mon Sep 17 00:00:00 2001 From: Teknium <127238744+teknium1@users.noreply.github.com> Date: Wed, 5 Aug 2026 00:06:43 -0700 Subject: [PATCH] fix(cron): tolerate NUL bytes in referenced-script paths at os.open Residual #76762 class: _read_referenced_script caught OSError from os.open but not ValueError, so a path token carrying an embedded NUL (tokenized binary-adjacent command text) crashed the terminal tool's lifecycle guard with 'ValueError: embedded null byte' instead of being skipped as nothing-to-scan. Reproduced live against main. Same treatment the resolve()-time site already has; two sabotage-verified regressions added. --- tests/hermes_cli/test_gateway_restart_loop.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tests/hermes_cli/test_gateway_restart_loop.py b/tests/hermes_cli/test_gateway_restart_loop.py index 29b0c02ff1fc5..51e56dcddc2b8 100644 --- a/tests/hermes_cli/test_gateway_restart_loop.py +++ b/tests/hermes_cli/test_gateway_restart_loop.py @@ -695,6 +695,21 @@ class TestLifecycleGuardModule: ) assert result is False + def test_nul_byte_in_path_token_does_not_crash_guard(self): + """Residual #76762 class: when a NUL byte survives into the *path + token itself* (tokenized binary-adjacent command text), ``os.open`` + raises ValueError — not OSError — inside + ``_read_referenced_script``. The guard must treat it as "nothing to + scan", never crash. + """ + from cron.lifecycle_guard import ( + contains_gateway_lifecycle_command_or_referenced_script, + ) + result = contains_gateway_lifecycle_command_or_referenced_script( + "bash ./run\x00me.sh", cwd="/tmp" + ) + assert result is False + def test_read_referenced_script_tolerates_nul_in_path(self): """#77703: _read_referenced_script opens by path. A path with an embedded NUL byte (a binary's bytes mis-tokenized into a bogus path by