# ArgumentError (string contains null byte)

**URL:** <https://discuss.rubyonrails.org/t/argumenterror-string-contains-null-byte/84271>\
**Category:** rubyonrails-core\
**Created:** [November 24, 2023, 1:52pm UTC](https://discuss.rubyonrails.org/t/argumenterror-string-contains-null-byte/84271 "2023-11-24T13:52:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![collimarco](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/collimarco/32/3794_2.png) [@collimarco](https://discuss.rubyonrails.org/u/collimarco)\
**Post date:** [November 24, 2023, 1:52pm UTC](https://discuss.rubyonrails.org/t/argumenterror-string-contains-null-byte/84271/1 "2023-11-24T13:52:30Z")

</div>

It’s an user-input… what am I supposed to do?

The code is pretty simple:

```ruby
@post = @project.posts.build post_params
@post.save

```

If some users pass a null byte through the REST API (post\_params), Rails produces a **500 Internal Server Error** on `save`. This is what I see from logs:

```ruby
ArgumentError (string contains null byte)

```

Why Rails doesn’t try to do something better? Like removing null bytes automatically or returning a 4xx error?

What is the correct solution to this 500 error?

---

<div class="post-metadata">

**Author:** ![collimarco](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/collimarco/32/3794_2.png) [@collimarco](https://discuss.rubyonrails.org/u/collimarco)\
**Post date:** [November 25, 2023, 6:57am UTC](https://discuss.rubyonrails.org/t/argumenterror-string-contains-null-byte/84271/2 "2023-11-25T06:57:04Z")

</div>

In the JSON standard (as defined by RFC 8259), null bytes (i.e., the byte with value 0x00) are not allowed within the JSON text.

This means that this is a **Rails bug**.

**When a JSON request is decoded into params, the strings should not contain null bytes. If a string contain null bytes, that is an invalid JSON and an appropriate 4xx error should be returned to the client.**

---

<div class="post-metadata">

**Author:** ![collimarco](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/collimarco/32/3794_2.png) [@collimarco](https://discuss.rubyonrails.org/u/collimarco)\
**Post date:** [November 25, 2023, 7:05am UTC](https://discuss.rubyonrails.org/t/argumenterror-string-contains-null-byte/84271/3 "2023-11-25T07:05:37Z")

</div>

I have opened an issue on GitHub:

> <https://github.com/rails/rails/issues/50166>
>
> \### Steps to reproduce
> 
> \`\`\`
> @post = @project.posts.build post\_params
> @post.s…ave
> \`\`\`
> 
> If some users pass a null byte through the REST API (post\_params), Rails produces a 500 Internal Server Error on save. This is what I see from logs:
> 
> \`\`\`
> ArgumentError (string contains null byte)
> \`\`\`
> 
> \### More details
> 
> In the JSON standard (as defined by RFC 8259), null bytes (i.e., the byte with value 0x00) are not allowed within the JSON text.
> 
> When a JSON request is decoded into params, the strings should not contain null bytes. If a string contains null bytes, that is an invalid JSON and an appropriate 4xx error should be returned to the client.
> 
> \### Expected behavior
> Rails returns a 4xx error when a JSON request is decoded if it contains null bytes.
> 
> \### Actual behavior
> Rails ignores the null bytes in the JSON string (and then raises a weird exception during \`.save\`).
> 
> \### System configuration
> \*\*Rails version\*\*: 7.1.2
> 
> \*\*Ruby version\*\*: 3.2.2