after a bit research, we still need the \x00 to be in badChars list to make the exploit works. Please see my latest commit 478beee