Skip to content

Handle null bytes in StaticFiles path#3139

Merged
Kludex merged 4 commits intomainfrom
fix/staticfiles-null-byte
Feb 14, 2026
Merged

Handle null bytes in StaticFiles path#3139
Kludex merged 4 commits intomainfrom
fix/staticfiles-null-byte

Conversation

@Kludex
Copy link
Owner

@Kludex Kludex commented Feb 14, 2026

A %00 in the URL path gets decoded by uvicorn into a null byte, which causes os.path.realpath() to raise ValueError inside lookup_path(). This was unhandled, resulting in a 500. Now returns 404.

@Kludex Kludex enabled auto-merge (squash) February 14, 2026 11:04
@Kludex Kludex merged commit 51057d5 into main Feb 14, 2026
6 checks passed
@Kludex Kludex deleted the fix/staticfiles-null-byte branch February 14, 2026 11:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant