aquasecurity / aquasecurity/tracee
v0.24.1: Tracee gRPC server tries to marshal invalid UTF-8 in strings
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
I'm attaching a `grpcurl` instance to the Tracee gRPC server (`tracee.v1beta1.TraceeService.StreamEvents` RPC) and I noticed `grpcurl` often dies with
```
ERROR:
Code: Internal
Message: grpc: error while marshaling: string field contains invalid UTF-8
```
I think Tracee gRPC server should implement more validation/sanitization of raw syscall arguments (like read/write buffers, paths, argv) that land into grpc string fields. Anything binary (ELF bytes, compressed data, UTF-16 paths, random memory) blows up marshaling...
## Output of `tracee version`:
```
v0.24.1
```
## Output of `uname -a`:
```
Linux agentbox 6.8.0-106-generic #106-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 6 07:58:08 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
```
## Additional details
Contributor guide
Research direction
Start at the tracee.v1beta1.TraceeService.StreamEvents gRPC entry point and reproduce with grpcurl using events containing raw syscall arguments such as buffers, paths, or argv. Trace which values reach string fields, define handling for invalid UTF-8, and verify grpcurl no longer fails while preserving valid text.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, grpc
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100