From a07ceaec36346a7c73e66efe35c8af4654029c84 Mon Sep 17 00:00:00 2001
From: Rudy Mizrahi Celekli <47457359+rudycelekli@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:51:29 -0400
Subject: [PATCH] fix(config): reject NUL bytes in Hopper loader arguments
 (#2474)

---
 src/config.test.ts    | 12 ++++++++++++
 src/config/parsers.ts | 13 +++++--------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/src/config.test.ts b/src/config.test.ts
index eb784802fa..67db7e1115 100644
--- a/src/config.test.ts
+++ b/src/config.test.ts
@@ -3,6 +3,18 @@ import { describe, expect, it } from "vitest";
 import { parseConfig } from "./config/parseConfig.js";
 import { projectAnalysisError } from "./domain/analysisErrorProjection.js";
 
+it("reports a configuration failure for a NUL in Hopper loader arguments", () => {
+  const result = parseConfig({
+    HOPPER_LOADER_ARGS_JSON: JSON.stringify(["--option", "value\0suffix"]),
+  });
+  if (result.ok)
+    throw new Error("NUL argv cannot be passed to a child process");
+  expect(result.error).toMatchObject({
+    settings: [{ setting: "HOPPER_LOADER_ARGS_JSON" }],
+  });
+  expect(result.error.message).toContain("NUL");
+});
+
 describe("runtime configuration", () => {
   it("allows target-free startup and applies runtime defaults", () => {
     const empty = parseConfig({});
diff --git a/src/config/parsers.ts b/src/config/parsers.ts
index fc842f8842..52feae6227 100644
--- a/src/config/parsers.ts
+++ b/src/config/parsers.ts
@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { ConfigurationError } from "../domain/configurationErrors.js";
+import { nulFreeStringSchema } from "../domain/localPath.js";
 import { err, ok, type Result } from "../domain/result.js";
 import { safeParseJson } from "../domain/safeJson.js";
 
@@ -20,7 +21,8 @@ export const parseLoaderArgs = (
   return parseConfiguredStringArray(
     encoded,
     "HOPPER_LOADER_ARGS_JSON",
-    z.string(),
+    nulFreeStringSchema,
+    "must encode an array of strings without NUL bytes",
   );
 };
 
@@ -28,6 +30,7 @@ const parseConfiguredStringArray = (
   encoded: string,
   setting: string,
   itemSchema: z.ZodString,
+  requirement = "must encode an array of strings",
 ): Result<readonly string[], ConfigurationError> => {
   const decoded = safeParseJson(encoded);
   if (!decoded.ok)
@@ -37,13 +40,7 @@ const parseConfiguredStringArray = (
   const parsed = z.array(itemSchema).safeParse(decoded.value);
   return parsed.success
     ? ok(parsed.data)
-    : err(
-        configuredArrayError(
-          setting,
-          "must encode an array of strings",
-          parsed.error,
-        ),
-      );
+    : err(configuredArrayError(setting, requirement, parsed.error));
 };
 
 const configuredArrayError = (