From 3b4b59c6affa8a8d2f6b452ab8ce9aa3914f7e00 Mon Sep 17 00:00:00 2001 From: zafar1162014 Date: Mon, 4 May 2026 00:27:54 +0500 Subject: [PATCH 1/2] Reject non-ASCII input in base64_decode and add regression test --- src/itsdangerous/encoding.py | 7 +++---- tests/test_itsdangerous/test_encoding.py | 5 +++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/itsdangerous/encoding.py b/src/itsdangerous/encoding.py index f5ca80f9..56874d59 100644 --- a/src/itsdangerous/encoding.py +++ b/src/itsdangerous/encoding.py @@ -29,12 +29,11 @@ def base64_decode(string: str | bytes) -> bytes: """Base64 decode a URL-safe string of bytes or text. The result is bytes. """ - string = want_bytes(string, encoding="ascii", errors="ignore") - string += b"=" * (-len(string) % 4) - try: + string = want_bytes(string, encoding="ascii") + string += b"=" * (-len(string) % 4) return base64.urlsafe_b64decode(string) - except (TypeError, ValueError) as e: + except (TypeError, ValueError, UnicodeError) as e: raise BadData("Invalid base64-encoded data") from e diff --git a/tests/test_itsdangerous/test_encoding.py b/tests/test_itsdangerous/test_encoding.py index 268367e6..a1cf3801 100644 --- a/tests/test_itsdangerous/test_encoding.py +++ b/tests/test_itsdangerous/test_encoding.py @@ -27,6 +27,11 @@ def test_base64_bad(): base64_decode("12345") +def test_base64_non_ascii(): + with pytest.raises(BadData): + base64_decode("abc😀") + + @pytest.mark.parametrize( ("value", "expect"), ((0, b""), (192, b"\xc0"), (18446744073709551615, b"\xff" * 8)) ) From 9554b32a684b94cecce8f86105a0858c89f745d9 Mon Sep 17 00:00:00 2001 From: muhammadzafarulhaq <134407621+zafar1162014@users.noreply.github.com> Date: Mon, 4 May 2026 01:00:56 +0500 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- src/itsdangerous/encoding.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/itsdangerous/encoding.py b/src/itsdangerous/encoding.py index 56874d59..ed4f6b8d 100644 --- a/src/itsdangerous/encoding.py +++ b/src/itsdangerous/encoding.py @@ -26,8 +26,9 @@ def base64_encode(string: str | bytes) -> bytes: def base64_decode(string: str | bytes) -> bytes: - """Base64 decode a URL-safe string of bytes or text. The result is - bytes. + """Base64 decode a URL-safe string of bytes or ASCII text. The + result is bytes. Non-ASCII text is invalid and will raise + :exc:`.BadData`. """ try: string = want_bytes(string, encoding="ascii")