Depending on how hard you squint, this could be either a Documentation bug or a Platform bug. If you call the canonicalize() function and pass-in an empty-string, the return value is NULL. I am calling this a Documentation bug because the canonicalize() page - https://docs.lucee.org/reference/functions/canonicalize.html - states nothing about this behavior. The docs state that a String is the return value.
See demonstration of behavior: https://www.bennadel.com/blog/3556-calling-canonicalize-on-an-empty-string-returns-null-in-lucee-5-2-9-31.htm