Re: Base64 decoder extremely (overly?) strict

Wed, 03 Sep 2003 16:08:31 -0700


Well yes that is right if your data conforms with a Schema that defines Base64
datatype, and the production says that you should have one or zero ( "S?" ) space.

But some users also used that class to take "content" to encode/decoded into Base64,
like some security folks that care about their linefeed and other whitespace being encoded
properly because when you do a digest the results would be obviously different.

Assuming (constraining ) its use to only Base64 datatypes is in my opinion was a mistake. At
leat I can speak for the Base64 class in Java implementation which was written as a generic
Base64 utiliity class ( I wrote that class :-) ).

My 2 cents,

                     Jeffrey Rodriguez
                    Silicon Valley


From: "PeiYong Zhang" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: <[EMAIL PROTECTED]>
Subject: Re: Base64 decoder extremely (overly?) strict
Date: Wed, 3 Sep 2003 16:09:23 -0400

Scott,

     Following is the production copied from the Schema Datatype errata
     (http://www.w3.org/2001/05/xmlschema-errata#Errata2), it allows
     optional ONE whitespace ONLY.
se64Binary  ::=  S? B64quartet* Base64final?
B64quartet    ::=  B64 S? B64 S? B64 S? B64 S?
B64final      ::=  B64 S? B04 S? '=' S? '=' S?
                | B64 S? B64 S? B16 S? '=' S?
B04         ::=  [AQgw]
B16         ::=  [AEIMQUYcgkosw048]
B64         ::=  [A-Za-z0-9+/]

Rgds,

PeiYong

----- Original Message -----

  From: Scott Cantor
  To: [EMAIL PROTECTED]
  Sent: Wednesday, September 03, 2003 3:20 PM
  Subject: Base64 decoder extremely (overly?) strict


There was a change made to the Base64.cpp source around Xerces 2.2 that has
created some real problems handling base64 encoded objects, in particular
because of linefeeds. I'm not sure what's legal and what's not, but I
thought I'd mention it, because if it's *allowable* to permit extra linefeed
characters and/or extra lines in the encoded data, it's really a hassle that
it doesn't permit it.

The culprit is the whitespace checking:

  if (inWhiteSpace)
                  return 0; // more than 1 whitespaces encountered
              else
                  inWhiteSpace = true;

A lot of Java code I'm dealing with, xml-security in particular, is creating
base64 that breaks on that line (returns 0 because of sequences of multiple
whitespace in the data due to extra linefeeds).

So, I could try reporting this as a bug there, but I'm not sure if it even
is.

-- Scott


  ---------------------------------------------------------------------
  To unsubscribe, e-mail: [EMAIL PROTECTED]
  For additional commands, e-mail: [EMAIL PROTECTED]


_________________________________________________________________
MSN 8: Get 6 months for $9.95/month. http://join.msn.com/?page=dept/dialup


---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to