Reject non-ASCII input in base64_decode and add regression test

src/itsdangerous/encoding.py

@@ -26,15 +26,15 @@ def base64_encode(string: str | bytes) -> bytes:
 
 
 def base64_decode(string: str | bytes) -> bytes:
-    """Base64 decode a URL-safe string of bytes or text. The result is
-    bytes.
+    """Base64 decode a URL-safe string of bytes or ASCII text. The
+    result is bytes. Non-ASCII text is invalid and will raise
+    :exc:`.BadData`.
     """
-    string = want_bytes(string, encoding="ascii", errors="ignore")
-    string += b"=" * (-len(string) % 4)
-
     try:
+        string = want_bytes(string, encoding="ascii")
+        string += b"=" * (-len(string) % 4)
         return base64.urlsafe_b64decode(string)
-    except (TypeError, ValueError) as e:
+    except (TypeError, ValueError, UnicodeError) as e:
         raise BadData("Invalid base64-encoded data") from e
 
 

tests/test_itsdangerous/test_encoding.py

@@ -27,6 +27,11 @@ def test_base64_bad():
         base64_decode("12345")
 
 
+def test_base64_non_ascii():
+    with pytest.raises(BadData):
+        base64_decode("abc😀")
+
+
 @pytest.mark.parametrize(
     ("value", "expect"), ((0, b""), (192, b"\xc0"), (18446744073709551615, b"\xff" * 8))
 )