Filter out null bytes in capec_map_enricher.py

The application should:

• Validate file paths for null bytes (and other invalid characters)
• Log a clear error message explaining the invalid input
• Exit gracefully (with an appropriate exit code)
• NOT crash with an unhandled ValueError

You should create a wrapper for validate_filepath:

def validate_filepath_no_nulls(value: str) -> str:
    """Validate filepath and ensure it contains no null bytes."""
    if '\x00' in value:
        raise argparse.ArgumentTypeError("File path cannot contain null bytes")
    return validate_filepath_arg(value)

Then hook this up during parse_arguments:

def parse_arguments(input_args: list[str]) -> argparse.Namespace:
    """Parse command line arguments."""
    parser = argparse.ArgumentParser(description="Enrich CAPEC mappings with names from CAPEC JSON catalog")
    parser.add_argument(
        "-c",
        "--capec-json",
        type=validate_filepath_no_nulls,  # Use custom validator
        default=EnricherVars.DEFAULT_CAPEC_JSON_PATH,
        help="Path to CAPEC JSON file (3000.json)",
    )
    parser.add_argument(
        "-i",
        "--input-path",
        type=validate_filepath_no_nulls,  # Use custom validator
        default=None,
        help="Path to input CAPEC mapping YAML file (overrides edition/version)",
    )
    # ... other path arguments also use validate_filepath_no_nulls ...
    parser.add_argument(
        "-s",
        "--source-dir",
        type=validate_filepath_no_nulls,  # Use custom validator
        default=EnricherVars.DEFAULT_SOURCE_DIR,
        help="Source directory containing CAPEC mapping files",
    )
    parser.add_argument(
        "-o",
        "--output-path",
        type=validate_filepath_no_nulls,  # Use custom validator
        default=None,
        help="Path to save enriched CAPEC mapping YAML file (default: overwrites input)",
    )
    parser.add_argument(
        "-v",
        "--version",
        type=lambda x: _validate_no_null_bytes(x, "version"),
        default="latest",
        help="Version of the Cornucopia (e.g., 3.0)",
    )
    parser.add_argument(
        "-e",
        "--edition",
        type=lambda x: _validate_no_null_bytes(x, "edition"),
        default="edition",
        help="Edition of the Cornucopia (e.g., webapp or mobileapp)",
    )
    parser.add_argument(
        "-d",
        "--debug",
        action="store_true",
        help="Output additional information to debug script",
    )
    try:
        args = parser.parse_args(input_args)
    except argparse.ArgumentTypeError as exc:
        logging.error("Invalid argument: %s", str(exc))
        sys.exit(1)
    except argparse.ArgumentError as exc:
        logging.error(exc.message)
        sys.exit(1)
    return args

You also need a wrapper for validating strings:

def _validate_no_null_bytes(value: str, field_name: str) -> str:
    """Validate that a string doesn't contain null bytes."""
    if '\x00' in value:
        raise argparse.ArgumentTypeError(f"Invalid {field_name}: contains null bytes")
    return value

Then in main, catch the error:

def main() -> None:
    """Main execution function."""
    enricher_vars.args = parse_arguments(sys.argv[1:])
    
    # Defensive validation for paths (catches fuzzed inputs that bypass argparse validation)
    for attr in ['input_path', 'output_path', 'capec_json', 'source_dir']:
        if hasattr(enricher_vars.args, attr):
            value = getattr(enricher_vars.args, attr)
            if value and '\x00' in str(value):
                logging.error("Invalid file path in %s: contains null bytes", attr)
                sys.exit(1)
    
    # Defensive validation for string arguments
    for attr in ['edition', 'version']:
        if hasattr(enricher_vars.args, attr):
            value = getattr(enricher_vars.args, attr)
            if value and '\x00' in str(value):
                logging.error("Invalid value in %s: contains null bytes", attr)
                sys.exit(1)