Handle URL-encoded NUL bytes (%00) in URL path and query (#877)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
Follow up on #869 

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

internal/api/server.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"encoding/json"
 	"log"
 	"net/http"
 	"strings"
@@ -17,19 +18,21 @@ import (
 	"github.com/modelcontextprotocol/registry/internal/telemetry"
 )
 
-// NulByteValidationMiddleware rejects requests containing NUL bytes in URL path or query parameters
-// This prevents PostgreSQL encoding errors and returns a proper 400 Bad Request
+// NulByteValidationMiddleware rejects requests containing NUL bytes in URL path or query parameters.
+// This prevents PostgreSQL encoding errors (SQLSTATE 22021) and returns a proper 400 Bad Request.
+// Checks for both literal NUL bytes (\x00) and URL-encoded form (%00).
 func NulByteValidationMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Check URL path for NUL bytes
-		if strings.ContainsRune(r.URL.Path, '\x00') {
-			http.Error(w, "Invalid request: URL path contains null bytes", http.StatusBadRequest)
+		// Check URL path for literal NUL bytes or URL-encoded %00
+		// Path needs %00 check because handlers call url.PathUnescape() which would decode it
+		if containsNulByte(r.URL.Path) {
+			writeErrorResponse(w, http.StatusBadRequest, "Invalid request: URL path contains null bytes")
 			return
 		}
 
-		// Check raw query string for NUL bytes
-		if strings.ContainsRune(r.URL.RawQuery, '\x00') {
-			http.Error(w, "Invalid request: query parameters contain null bytes", http.StatusBadRequest)
+		// Check raw query string for literal NUL bytes or URL-encoded %00
+		if containsNulByte(r.URL.RawQuery) {
+			writeErrorResponse(w, http.StatusBadRequest, "Invalid request: query parameters contain null bytes")
 			return
 		}
 
@@ -37,6 +40,32 @@ func NulByteValidationMiddleware(next http.Handler) http.Handler {
 	})
 }
 
+// writeErrorResponse writes a JSON error response using huma's ErrorModel format
+// for consistency with the rest of the API.
+func writeErrorResponse(w http.ResponseWriter, status int, detail string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+
+	errModel := &huma.ErrorModel{
+		Title:  http.StatusText(status),
+		Status: status,
+		Detail: detail,
+	}
+	_ = json.NewEncoder(w).Encode(errModel)
+}
+
+// containsNulByte checks if a string contains a NUL byte, either as a literal \x00
+// or URL-encoded as %00.
+func containsNulByte(s string) bool {
+	// Check for literal NUL byte
+	if strings.ContainsRune(s, '\x00') {
+		return true
+	}
+	// Check for URL-encoded NUL byte (%00)
+	// Using Contains directly since %00 has no case variation (both hex digits are 0)
+	return strings.Contains(s, "%00")
+}
+
 // TrailingSlashMiddleware redirects requests with trailing slashes to their canonical form
 func TrailingSlashMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {