diff --git a/src/OneScript.StandardLibrary/PathHelper.cs b/src/OneScript.StandardLibrary/PathHelper.cs
index a7fd9d3c2..444b3cbf7 100644
--- a/src/OneScript.StandardLibrary/PathHelper.cs
+++ b/src/OneScript.StandardLibrary/PathHelper.cs
@@ -13,18 +13,20 @@ namespace OneScript.StandardLibrary
internal static class PathHelper
{
///
- /// Strips null characters from a path string.
- /// This is needed because Windows WebDAV client can add null characters to paths,
+ /// Strips trailing null characters from a path string.
+ /// This is needed because Windows WebDAV client can add null characters to the end of paths,
/// which causes ArgumentException in System.IO methods.
+ /// Only trailing null characters are removed to avoid masking potential security issues
+ /// with null characters in the middle of paths (e.g., "file.txt\0.exe").
///
- /// Path that may contain null characters
- /// Path with null characters removed, or null if input was null
+ /// Path that may contain trailing null characters
+ /// Path with trailing null characters removed, or null if input was null
public static string StripNullCharacters(string path)
{
if (path == null)
return null;
- return path.Replace("\0", "");
+ return path.TrimEnd('\0');
}
}
}