From f73674ee79ebdb564e692b46121ff335005c5247 Mon Sep 17 00:00:00 2001
From: Archkon <180910180+Archkon@users.noreply.github.com>
Date: Mon, 27 Jul 2026 14:24:49 +0800
Subject: [PATCH] sea: handle NUL bytes in asset keys

Construct the asset lookup string_view with the explicit Utf8Value
length so embedded NUL bytes do not truncate keys.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
---
 src/node_sea.cc                          | 2 +-
 test/fixtures/sea/assets/sea-config.json | 2 ++
 test/fixtures/sea/assets/sea.js          | 6 ++++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/node_sea.cc b/src/node_sea.cc
index 1be41e6f14146e..41b0cd9b97e32e 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -829,7 +829,7 @@ void GetAsset(const FunctionCallbackInfo<Value>& args) {
   if (sea_resource.assets.empty()) {
     return;
   }
-  auto it = sea_resource.assets.find(*key);
+  auto it = sea_resource.assets.find(std::string_view(*key, key.length()));
   if (it == sea_resource.assets.end()) {
     return;
   }
diff --git a/test/fixtures/sea/assets/sea-config.json b/test/fixtures/sea/assets/sea-config.json
index 78a64534b44e9d..979bda0dca13c4 100644
--- a/test/fixtures/sea/assets/sea-config.json
+++ b/test/fixtures/sea/assets/sea-config.json
@@ -2,6 +2,8 @@
   "main": "sea.js",
   "output": "sea-prep.blob",
   "assets": {
+    "a": "utf8_test_text.txt",
+    "a\u0000b": "person.jpg",
     "utf8_test_text.txt": "utf8_test_text.txt",
     "person.jpg": "person.jpg"
   }
diff --git a/test/fixtures/sea/assets/sea.js b/test/fixtures/sea/assets/sea.js
index e1a2189aa4da26..b6b775fdd15944 100644
--- a/test/fixtures/sea/assets/sea.js
+++ b/test/fixtures/sea/assets/sea.js
@@ -54,6 +54,12 @@ assert(isSea());
 const textAssetOnDisk = readFileSync(process.env.__TEST_UTF8_TEXT_PATH, 'utf8');
 const binaryAssetOnDisk = readFileSync(process.env.__TEST_PERSON_JPG);
 
+// Check asset keys containing NUL.
+{
+  assert.strictEqual(getAsset('a', 'utf8'), textAssetOnDisk);
+  assert.deepStrictEqual(Buffer.from(getAsset('a\0b')), binaryAssetOnDisk);
+}
+
 // Check getAsset() buffer copies.
 {
   // Check that the asset embedded is the same as the original.