#2080·sinatra

`uri`/`url` helper can blow up with `ArgumentError - string contains null byte`

Author: dentargCreated Feb 1, 2025Updated Feb 25, 2026
Labelsbugquestion

The app

ruby
$ cat app.rb
require "sinatra"

get "/" do
  body url(params[:foo])
end

The request

curl 'localhost:31337/?foo=%00'

bash
$ puma -p 31337
Puma starting in single mode...
* Puma version: 6.6.0 ("Return to Forever")
* Ruby version: ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [arm64-darwin23]
*  Min threads: 0
*  Max threads: 5
*  Environment: development
*          PID: 47058
* Listening on http://0.0.0.0:31337
Use Ctrl-C to stop
2025-02-01 23:32:52 - ArgumentError - string contains null byte:

	      File.join uri
	                ^^^
	/Users/dentarg/.arm64_rubies/3.3.6/lib/ruby/gems/3.3.0/gems/sinatra-4.1.1/lib/sinatra/base.rb:342:in `join'
	/Users/dentarg/.arm64_rubies/3.3.6/lib/ruby/gems/3.3.0/gems/sinatra-4.1.1/lib/sinatra/base.rb:342:in `uri'
	/Users/dentarg/code-snippets/sinatra-4/url-bug/app.rb:4:in `block in <top (required)>'
...

So this method

https://github.com/sinatra/sinatra/blob/c4b7c04e6d23ef8e17404d64cc731bece268acea/lib/sinatra/base.rb#L326-L343