[
https://issues.apache.org/jira/browse/CAUSEWAY-4045?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andi Huber reassigned CAUSEWAY-4045:
------------------------------------
Assignee: Andi Huber
> [BUG] DataUri record uses invalid SVG media type and unsafe Base64 encoding
> ---------------------------------------------------------------------------
>
> Key: CAUSEWAY-4045
> URL: https://issues.apache.org/jira/browse/CAUSEWAY-4045
> Project: Causeway
> Issue Type: Bug
> Components: Core
> Affects Versions: 4.0.0-M2
> Reporter: Miklós Győrfi
> Assignee: Andi Huber
> Priority: Minor
>
> {panel}
> *
> The {{org.apache.causeway.commons.net.DataUri}} record (introduced in
> Causeway 4.0) has several compliance and interoperability issues with RFC
> 2397 and W3C standards.
> h3. 1. Incorrect SVG MIME Type
> {{DataUri.ImageType.SVG.mediaType()}} currently returns {{{}image/svg{}}},
> while the correct IANA-registered media type is {{{}image/svg+xml{}}}.
> This causes rendering failures in browsers and in Wicket image components
> when SVGs are embedded via Data URIs.
> *Expected:*
> {{image/svg+xml}}
> ----
> h3. 2. Unsafe Base64 Encoding in {{toExternalForm()}}
> The current implementation uses:
> {{Base64.getEncoder()}}
> This encoder produces {{+}} and {{/}} characters, which are not URL-safe.
> When embedded into Wicket/HTML URLs, {{+}} characters may be interpreted as
> spaces ({{ }}), corrupting the Base64 payload.
> *Suggested fix:*
> Use a URL-safe encoder:
> {{Base64.getUrlEncoder()}}
> This avoids character transformation issues during HTTP transport.
> ----
> h3. 3. Fragile {{parse()}} and {{decodeData()}} Implementation
> The current decoding logic is too strict and fails in common real-world
> scenarios:
> * Uses {{Base64.getDecoder()}} → rejects URL-safe Base64 ({{{}-{}}},
> {{{}_{}}})
> * Fails on payloads containing whitespace or line breaks
> *Problems:*
> * Cannot parse valid URL-safe Data URIs
> * Breaks interoperability with externally generated Data URIs
> *Suggested improvement:*
> Use a more tolerant decoding strategy, e.g.:
> {{Base64.getUrlDecoder()}}
> and/or fallback to:
> {{Base64.getMimeDecoder()}}
> to support whitespace and line-wrapped payloads.
> ----
> h2. Expected Behavior
> * {{ImageType.SVG.mediaType()}} returns {{"image/svg+xml"}}
> * Base64 encoding is URL-safe and robust in HTTP contexts
> * Parsing supports both standard and URL-safe Base64 variants
> * Data URIs are fully compliant with RFC 2397 and interoperable across
> browsers and frameworks
> {panel}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
