Skip to content

Fix Base64{Url} incorrectly handling small destinations when inputs contain whitespace#123223

Merged
MihaZupan merged 7 commits into
mainfrom
copilot/fix-base64url-whitespace-handling
Jan 16, 2026
Merged

Fix Base64{Url} incorrectly handling small destinations when inputs contain whitespace#123223
MihaZupan merged 7 commits into
mainfrom
copilot/fix-base64url-whitespace-handling

Conversation

Copilot AI commented Jan 15, 2026

Copy link
Copy Markdown
Contributor

Description

Base64{Url}.DecodeFromUtf8 and DecodeFromChars incorrectly return DestinationTooSmall when input contains whitespace and destination is small but sufficient for actual data.

byte[] input = Encoding.UTF8.GetBytes("  zA==  ");
Base64Url.DecodeFromUtf8(input, new byte[5]); // ✓ writes 1 byte
Base64Url.DecodeFromUtf8(input, new byte[1]); // ✗ was: "Destination is too short"

Base64Url.DecodeFromChars(new string(' ', 8), new byte[1]); // ✗ was: "Destination is too short"

Root cause: DecodeFrom calculates maxSrcLength from total source length (including whitespace). When destLength < decodedLength - 2, it jumps to DestinationTooSmallExit before the whitespace-handling fallback can strip whitespace and re-evaluate.

Fix: At DestinationTooSmallExit, when ignoreWhiteSpace is true, fall through to InvalidDataFallback which properly handles whitespace and determines if the actual content fits.

  • Base64DecoderHelper.cs: Added fallthrough to InvalidDataExit when ignoreWhiteSpace is true
  • Base64UrlDecoderUnitTests.cs: Added tests for leading/trailing whitespace scenarios that reproduce the issue
  • Base64UrlDecoderUnitTests.cs: Added tests for embedded whitespace scenarios (e.g., "z A==") that trigger the DecodeWithWhiteSpaceBlockwiseWrapper path
  • Base64DecoderUnitTests.cs: Added similar tests for the Base64 decoder since both Base64 and Base64Url share the same underlying implementation
  • Added test cases for whitespace-only input with empty destination buffer (size 0)
Original prompt

This section details on the original issue you should resolve

<issue_title>Base64{Url} incorrectly handles small destinations when inputs contain whitespace</issue_title>
<issue_description>```c#
byte[] input = Encoding.UTF8.GetBytes(" zA== ");
Console.WriteLine(Base64Url.DecodeFromUtf8(input, new byte[5])); // writes 1 byte
Console.WriteLine(Base64Url.DecodeFromUtf8(input, new byte[1])); // "Destination is too short."


```c#
_ = Base64Url.DecodeFromChars(new string(' ', 8), new byte[1]); // "Destination is too short."

Our logic in the core DecodeFrom workhorse isn't properly accounting for the possibility of skippable whitespace when calculating how much input we can process for a given destination size.</issue_description>

Comments on the Issue (you are @copilot in this section)


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 2 commits January 15, 2026 18:38
…contains whitespace

When ignoreWhiteSpace is true, the DestinationTooSmallExit path now falls
through to InvalidDataFallback, which properly handles whitespace and
determines if the actual content fits in the destination.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
…cumentation

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix Base64Url decoding for whitespace in small destinations Jan 15, 2026
Copilot AI requested a review from stephentoub January 15, 2026 18:48
@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/area-system-buffers
See info in area-owners.md if you want to be subscribed.

@stephentoub stephentoub marked this pull request as ready for review January 15, 2026 19:52

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request fixes a bug in Base64{Url}.DecodeFromUtf8 and DecodeFromChars where they incorrectly return DestinationTooSmall when the input contains whitespace and the destination is small but sufficient for the actual data.

Changes:

  • Fixed the core decoder logic to fall through to whitespace-handling fallback when ignoreWhiteSpace is true at the DestinationTooSmallExit label
  • Added comprehensive regression tests for the bug scenarios

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
src/libraries/System.Private.CoreLib/src/System/Buffers/Text/Base64Helper/Base64DecoderHelper.cs Added fallthrough to InvalidDataExit when ignoreWhiteSpace is true at DestinationTooSmallExit, allowing whitespace to be stripped and destination size to be re-evaluated
src/libraries/System.Memory/tests/Base64Url/Base64UrlDecoderUnitTests.cs Added three test methods covering: decoding with whitespace into small destination for UTF8 and chars, and verifying genuine DestinationTooSmall errors are still reported correctly
Copilot AI and others added 2 commits January 15, 2026 20:16
Tests embedded whitespace scenarios (e.g., "z A==") which trigger the
block-wise decoding fallback path for both DecodeFromUtf8 and DecodeFromChars.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
Added similar tests for the Base64 decoder that were already present for
Base64Url, since both share the same underlying implementation.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>
Tests that whitespace-only inputs work correctly with an empty (size 0)
destination buffer, since decoding produces 0 output bytes.

Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

4 participants