[CODEC-134] Base32 would decode some invalid Base32 encoded string into arbitrary value

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6
• Fix Version/s: 1.13
• Labels: security

Environment

All

• Assignee: Gary D. Gregory
• Reporter: Hanson Char
• Created: 03/Mar/12 23:14
• Updated: 10/Apr/21 15:43
• Resolved: 20/May/19 15:40

Description

Example, there is no byte array value that can be encoded into the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4L===", but the existing Base32 implementation would not reject it but decode it into an arbitrary value which if re-encoded again using the same implementation would result in the string "C5CYMIHWQUUZMKUGZHGEOSJSQDE4K===".

Instead of blindly decoding the invalid string, the Base32 codec should reject it (eg by throwing IlleglArgumentException) to avoid security exploitation (such as tunneling additional information via seemingly valid base 32 strings).

Issue Links

• causes: HTTPCLIENT-2150 Update to Apache Commons Codec 1.15
• is related to: WAGON-609 Upgrade transitive Commons Codec to 1.15
• relates to: CODEC-270 Base32 and Base64 still allow decoding some invalid trailing characters
• relates to: CODEC-280 Base32/64 to allow optional strict/lenient decoding
• links to: GitHub Pull Request #19