fix: prevent zero-byte remote state writes (#37947)

internal/states/remote/remote_grpc.go

@@ -79,6 +79,15 @@ func (g *grpcClient) Get() (*Payload, tfdiags.Diagnostics) {
 //
 // Implementation of remote.Client
 func (g *grpcClient) Put(state []byte) tfdiags.Diagnostics {
+	if len(state) == 0 {
+		var diags tfdiags.Diagnostics
+		return diags.Append(tfdiags.Sourceless(
+			tfdiags.Error,
+			"Refusing to write empty remote state snapshot",
+			"Terraform produced an empty state file and will not upload it to remote storage. This indicates a bug in Terraform; please report it.",
+		))
+	}
+
 	req := providers.WriteStateBytesRequest{
 		TypeName: g.typeName,
 		StateId:  g.stateId,

internal/states/remote/remote_grpc_test.go

@@ -221,6 +221,31 @@ func Test_grpcClient_Put(t *testing.T) {
 			t.Fatalf("expected error to contain %q, but got: %s", expectedErr, err.Error())
 		}
 	})
+
+	t.Run("grpcClient refuses zero-byte writes", func(t *testing.T) {
+		provider := testing_provider.MockProvider{
+			ConfigureProviderCalled:   true,
+			ConfigureStateStoreCalled: true,
+			WriteStateBytesFn: func(req providers.WriteStateBytesRequest) providers.WriteStateBytesResponse {
+				t.Fatal("expected WriteStateBytes not to be called for zero-byte payload")
+				return providers.WriteStateBytesResponse{}
+			},
+		}
+
+		client := &grpcClient{
+			provider: &provider,
+			typeName: typeName,
+			stateId:  stateId,
+		}
+
+		diags := client.Put(nil)
+		if !diags.HasErrors() {
+			t.Fatalf("expected diagnostics when attempting to write zero bytes")
+		}
+		if provider.WriteStateBytesCalled {
+			t.Fatalf("provider WriteStateBytes should not be called")
+		}
+	})
 }
 
 // Testing grpcClient's Delete method.