From 91771412cc8f71e8102e0cce85abf5f0965d92a8 Mon Sep 17 00:00:00 2001
From: ishaanlabs-gg <64529428+ishaanlabs-gg@users.noreply.github.com>
Date: Thu, 2 Jul 2026 22:18:18 +0530
Subject: [PATCH] Keep URL-safe base64 decoding strict

---
 CHANGES.rst                              | 2 ++
 src/itsdangerous/encoding.py             | 2 +-
 tests/test_itsdangerous/test_encoding.py | 5 +++--
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index 17c1a196..0b1ddad3 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -5,6 +5,8 @@ Unreleased
 
 -   Drop support for Python 3.8 and 3.9.
 -   Remove previously deprecated code.
+-   Keep URL-safe base64 decoding strict when non-alphabet characters are
+    present. :issue:`420`
 
 
 Version 2.2.0
diff --git a/src/itsdangerous/encoding.py b/src/itsdangerous/encoding.py
index f5ca80f9..287a70f0 100644
--- a/src/itsdangerous/encoding.py
+++ b/src/itsdangerous/encoding.py
@@ -33,7 +33,7 @@ def base64_decode(string: str | bytes) -> bytes:
     string += b"=" * (-len(string) % 4)
 
     try:
-        return base64.urlsafe_b64decode(string)
+        return base64.b64decode(string, altchars=b"-_", validate=True)
     except (TypeError, ValueError) as e:
         raise BadData("Invalid base64-encoded data") from e
 
diff --git a/tests/test_itsdangerous/test_encoding.py b/tests/test_itsdangerous/test_encoding.py
index 268367e6..56561ca5 100644
--- a/tests/test_itsdangerous/test_encoding.py
+++ b/tests/test_itsdangerous/test_encoding.py
@@ -22,9 +22,10 @@ def test_base64(value):
     assert dec == want_bytes(value)
 
 
-def test_base64_bad():
+@pytest.mark.parametrize("value", ("12345", "AAAA.AAAA"))
+def test_base64_bad(value):
     with pytest.raises(BadData):
-        base64_decode("12345")
+        base64_decode(value)
 
 
 @pytest.mark.parametrize(