[
https://issues.apache.org/jira/browse/CAUSEWAY-4045?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Miklós Győrfi updated CAUSEWAY-4045:
------------------------------------
Description:
{panel}
* The {{org.apache.causeway.commons.net.DataUri}} record (introduced in
Causeway 4.0) has several compliance and interoperability issues with RFC 2397
and W3C standards.
h3. Incorrect SVG MIME Type
{{DataUri.ImageType.SVG.mediaType()}} currently returns {{{}image/svg{}}},
while the correct IANA-registered media type is {{{}image/svg+xml{}}}.
This causes rendering failures in browsers and in Wicket image components when
SVGs are embedded via Data URIs.
*Expected:*
{{image/svg+xml}}
----
h2. Expected Behavior
* {{ImageType.SVG.mediaType()}} returns {{"image/svg+xml"}}
{panel}
was:
{panel}
*
The {{org.apache.causeway.commons.net.DataUri}} record (introduced in Causeway
4.0) has several compliance and interoperability issues with RFC 2397 and W3C
standards.
h3. 1. Incorrect SVG MIME Type
{{DataUri.ImageType.SVG.mediaType()}} currently returns {{{}image/svg{}}},
while the correct IANA-registered media type is {{{}image/svg+xml{}}}.
This causes rendering failures in browsers and in Wicket image components when
SVGs are embedded via Data URIs.
*Expected:*
{{image/svg+xml}}
----
h3. 2. Unsafe Base64 Encoding in {{toExternalForm()}}
The current implementation uses:
{{Base64.getEncoder()}}
This encoder produces {{+}} and {{/}} characters, which are not URL-safe. When
embedded into Wicket/HTML URLs, {{+}} characters may be interpreted as spaces
({{ }}), corrupting the Base64 payload.
*Suggested fix:*
Use a URL-safe encoder:
{{Base64.getUrlEncoder()}}
This avoids character transformation issues during HTTP transport.
----
h3. 3. Fragile {{parse()}} and {{decodeData()}} Implementation
The current decoding logic is too strict and fails in common real-world
scenarios:
* Uses {{Base64.getDecoder()}} → rejects URL-safe Base64 ({{{}-{}}}, {{{}_{}}})
* Fails on payloads containing whitespace or line breaks
*Problems:*
* Cannot parse valid URL-safe Data URIs
* Breaks interoperability with externally generated Data URIs
*Suggested improvement:*
Use a more tolerant decoding strategy, e.g.:
{{Base64.getUrlDecoder()}}
and/or fallback to:
{{Base64.getMimeDecoder()}}
to support whitespace and line-wrapped payloads.
----
h2. Expected Behavior
* {{ImageType.SVG.mediaType()}} returns {{"image/svg+xml"}}
* Base64 encoding is URL-safe and robust in HTTP contexts
* Parsing supports both standard and URL-safe Base64 variants
* Data URIs are fully compliant with RFC 2397 and interoperable across
browsers and frameworks
{panel}
> [BUG] DataUri record uses invalid SVG media type and unsafe Base64 encoding
> ---------------------------------------------------------------------------
>
> Key: CAUSEWAY-4045
> URL: https://issues.apache.org/jira/browse/CAUSEWAY-4045
> Project: Causeway
> Issue Type: Bug
> Components: Core
> Affects Versions: 4.0.0-M2
> Reporter: Miklós Győrfi
> Assignee: Andi Huber
> Priority: Minor
> Fix For: 4.0.0
>
>
> {panel}
> * The {{org.apache.causeway.commons.net.DataUri}} record (introduced in
> Causeway 4.0) has several compliance and interoperability issues with RFC
> 2397 and W3C standards.
> h3. Incorrect SVG MIME Type
> {{DataUri.ImageType.SVG.mediaType()}} currently returns {{{}image/svg{}}},
> while the correct IANA-registered media type is {{{}image/svg+xml{}}}.
> This causes rendering failures in browsers and in Wicket image components
> when SVGs are embedded via Data URIs.
> *Expected:*
> {{image/svg+xml}}
> ----
>
> h2. Expected Behavior
> * {{ImageType.SVG.mediaType()}} returns {{"image/svg+xml"}}
>
> {panel}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
