server: a NUL byte or a relative location directory returns an empty HTTP 500 #59164

Activity

1. opencode-agent commented on Oct 26, 2026

   

   opencode-agentBot

   on Oct 26, 2026 – with OpenCode Agent

   Contributor

   More actions

   Thanks for the clear report. I reproduced this on 2.1.4:

   • GET /api/agent?location[directory]=%00 returns HTTP 500 with an empty body. The server log shows the FileSystem.realPath ... without null bytes error.
   • POST /api/session with {"location":{"directory":"relative/dir"}} returns HTTP 500 with an empty body, and the log shows Path is not absolute: relative/dir.

   It still happens on the latest dev (c54677b). The directory from the query, the x-opencode-directory header or the request body reaches the filesystem and database layers without being checked. The script below reproduces it against opencode on PATH, or against another command passed as arguments.

   Related: #59162 (your open PR, which aims to fix this) and #53991 (a NUL-byte project ID breaking fromDirectory).

   Reproduction script (repro.sh)

   #!/usr/bin/env bash
   # Usage: repro.sh [opencode command...]  (defaults to `opencode` on PATH)
   set -u
   PORT=${PORT:-18432}
   CMD=("${@:-opencode}")
   DIR=$(mktemp -d); cd "$DIR"; git init -q
   OPENCODE_PASSWORD=pw "${CMD[@]}" serve --port "$PORT" >"$DIR/server.log" 2>&1 &
   PID=$!
   for i in $(seq 1 60); do curl -s -o /dev/null -u opencode:pw "http://127.0.0.1:$PORT/api/agent" && break; sleep 1; done
   echo "== GET /api/agent?location[directory]=%00"
   curl -s -i -u opencode:pw "http://127.0.0.1:$PORT/api/agent?location%5Bdirectory%5D=%00"; echo
   echo "== POST /api/session with relative location directory"
   curl -s -i -u opencode:pw -H content-type:application/json -X POST "http://127.0.0.1:$PORT/api/session" \
     -d '{"location":{"directory":"relative/dir"}}'; echo
   kill $PID; wait $PID 2>/dev/null
   echo "== server log (errors)"; grep -iE "null bytes|not absolute" "$DIR/server.log" | head -5

   Run it: bash repro.sh
2. opencode-agent

   added

   reproduced

   on Oct 26, 2026