Miklós Győrfi created CAUSEWAY-4045:
---------------------------------------
Summary: [BUG] DataUri record uses invalid SVG media type and
unsafe Base64 encoding
Key: CAUSEWAY-4045
URL: https://issues.apache.org/jira/browse/CAUSEWAY-4045
Project: Causeway
Issue Type: Bug
Components: Core
Affects Versions: 4.0.0-M2
Reporter: Miklós Győrfi
{panel}
*
The {{org.apache.causeway.commons.net.DataUri}} record (introduced in Causeway
4.0) has several compliance and interoperability issues with RFC 2397 and W3C
standards.
h3. 1. Incorrect SVG MIME Type
{{DataUri.ImageType.SVG.mediaType()}} currently returns {{{}image/svg{}}},
while the correct IANA-registered media type is {{{}image/svg+xml{}}}.
This causes rendering failures in browsers and in Wicket image components when
SVGs are embedded via Data URIs.
*Expected:*
{{image/svg+xml}}
----
h3. 2. Unsafe Base64 Encoding in {{toExternalForm()}}
The current implementation uses:
{{Base64.getEncoder()}}
This encoder produces {{+}} and {{/}} characters, which are not URL-safe. When
embedded into Wicket/HTML URLs, {{+}} characters may be interpreted as spaces
({{ }}), corrupting the Base64 payload.
*Suggested fix:*
Use a URL-safe encoder:
{{Base64.getUrlEncoder()}}
This avoids character transformation issues during HTTP transport.
----
h3. 3. Fragile {{parse()}} and {{decodeData()}} Implementation
The current decoding logic is too strict and fails in common real-world
scenarios:
* Uses {{Base64.getDecoder()}} → rejects URL-safe Base64 ({{{}-{}}}, {{{}_{}}})
* Fails on payloads containing whitespace or line breaks
*Problems:*
* Cannot parse valid URL-safe Data URIs
* Breaks interoperability with externally generated Data URIs
*Suggested improvement:*
Use a more tolerant decoding strategy, e.g.:
{{Base64.getUrlDecoder()}}
and/or fallback to:
{{Base64.getMimeDecoder()}}
to support whitespace and line-wrapped payloads.
----
h2. Expected Behavior
* {{ImageType.SVG.mediaType()}} returns {{"image/svg+xml"}}
* Base64 encoding is URL-safe and robust in HTTP contexts
* Parsing supports both standard and URL-safe Base64 variants
* Data URIs are fully compliant with RFC 2397 and interoperable across
browsers and frameworks
{panel}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
