Whole file
authlib/joserfc
The author described this change as “fix: throw an error on non-valid base64 strings”. It counts as a record because the check below fails on the code as it stood at 6329b74ed and passes on 2b95926d2, with nothing else changed between the two runs.
Projectauthlib/joserfc
Fix saved2024-12-03
Sharing licenceBSD-3-Clause · LICENSE
Change size+4 −1
What the code was meant to do, written into the code itself as a save note
fix: throw an error on non-valid base64 strings
The change
| 2 | 2 | from typing import Any | |
| 3 | 3 | import base64 | |
| 4 | 4 | import struct | |
| 5 | + | import binascii | |
| 5 | 6 | import json | |
| 6 | 7 | ||
| 7 | 8 | ||
| ⋯ | |||
| 26 | 27 | ||
| 27 | 28 | ||
| 28 | 29 | def urlsafe_b64decode(s: bytes) -> bytes: | |
| 30 | + | if b"+" in s or b"/" in s: | |
| 31 | + | raise binascii.Error | |
| 29 | 32 | s += b"=" * (-len(s) % 4) | |
| 30 | - | return base64.urlsafe_b64decode(s) | |
| 33 | + | return base64.b64decode(s, b"-_", validate=True) | |
| 31 | 34 | ||
| 32 | 35 | ||
| 33 | 36 | def urlsafe_b64encode(s: bytes) -> bytes: | |
The check that tells the two apart
fail→pass·tests/test_util.py::TestUtil::test_urlsafe_b64decode
Check file tests/test_util.py, taken without changes from the fix and copied onto the older code, so the exact same check runs against both versions.
Origin and history
The code before it6329b74edb21c0eac9b707bc07d990515ca98ab1
Broken version dated2024-09-25
Modulejoserfc.util
Units changedurlsafe_b64decode
Fingerprint2153253a372f5a83
Checked2026-08-18 by goldset/0.1
Every field above is generated by our program. None of it is written by hand.