Make atob() throw an InvalidCharacterError on excess padding characters

Source/wtf/text/Base64.cpp

 /*
    Copyright (C) 2000-2001 Dawit Alemayehu <adawit@kde.org>
    Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
    Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
    Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU Lesser General Public License (LGPL)
    version 2 as published by the Free Software Foundation.
 
@@ skipping 110 matching lines @@
             out[didx++] = base64EncMap[(data[sidx] << 4) & 077];
     }
 
     // Add padding
     while (didx < out.size()) {
         out[didx] = '=';
         ++didx;
     }
 }
 
-bool base64Decode(const Vector<char>& in, Vector<char>& out, Base64DecodePolicy policy)
+bool base64Decode(const Vector<char>& in, Vector<char>& out, Base64InvalidCharactersPolicy charactersPolicy, Base64PaddingValidationPolicy paddingPolicy)
 {
     out.clear();
 
     // If the input string is pathologically large, just return nothing.
     if (in.size() > UINT_MAX)
         return false;
 
-    return base64Decode(in.data(), in.size(), out, policy);
+    return base64Decode(in.data(), in.size(), out, charactersPolicy, paddingPolicy);
 }
 
 template<typename T>
-static inline bool base64DecodeInternal(const T* data, unsigned len, Vector<char>& out, Base64DecodePolicy policy)
+static inline bool base64DecodeInternal(const T* data, unsigned length, Vector<char>& out, Base64InvalidCharactersPolicy charactersPolicy, Base64PaddingValidationPolicy paddingPolicy)
 {
     out.clear();
-    if (!len)
+    if (!length)
         return true;
 
-    out.grow(len);
+    unsigned dataLength = length;
+    if (paddingPolicy == Base64StrictPaddingValidation) {
+        if (!(dataLength % 4)) {
+            // There may be 2 = padding max.
+            while (data[dataLength - 1] == '=' && dataLength >= (length - 2))
+                --dataLength;
+        }
+        if (dataLength % 4 == 1)
+            return false;
+    }
+
+    out.grow(length);
 
     bool sawEqualsSign = false;
     unsigned outLength = 0;
-    for (unsigned idx = 0; idx < len; ++idx) {
+    for (unsigned idx = 0; idx < length; ++idx) {
         unsigned ch = data[idx];
-        if (ch == '=')
+        if (ch == '=') {
             sawEqualsSign = true;
+            if (paddingPolicy == Base64StrictPaddingValidation && idx < dataLength)
+                return false;
+        }

[arv (Not doing code reviews), 2013/07/17 17:49:06]

} else if (...) {

         else if (('0' <= ch && ch <= '9') || ('A' <= ch && ch <= 'Z') || ('a' <= ch && ch <= 'z') || ch == '+' || ch == '/') {
             if (sawEqualsSign)
                 return false;
             out[outLength] = base64DecMap[ch];
             ++outLength;
-        } else if (policy == Base64FailOnInvalidCharacter || (policy == Base64IgnoreWhitespace && !isSpaceOrNewline(ch)))
+        } else if (charactersPolicy == Base64FailOnInvalidCharacter || (charactersPolicy == Base64IgnoreWhitespace && !isSpaceOrNewline(ch)))
             return false;
     }
 
     if (!outLength)
         return !sawEqualsSign;
 
     // Valid data is (n * 4 + [0,2,3]) characters long.
     if ((outLength % 4) == 1)
         return false;
     
@@ skipping 19 matching lines @@
 
     if (++didx < outLength)
         out[didx] = (((out[sidx + 1] << 4) & 255) | ((out[sidx + 2] >> 2) & 017));
 
     if (outLength < out.size())
         out.shrink(outLength);
 
     return true;
 }
 
-bool base64Decode(const char* data, unsigned length, Vector<char>& out, Base64DecodePolicy policy)
+bool base64Decode(const char* data, unsigned length, Vector<char>& out, Base64InvalidCharactersPolicy charactersPolicy, Base64PaddingValidationPolicy paddingPolicy)
 {
-    return base64DecodeInternal<LChar>(reinterpret_cast<const LChar*>(data), length, out, policy);
+    return base64DecodeInternal<LChar>(reinterpret_cast<const LChar*>(data), length, out, charactersPolicy, paddingPolicy);
 }
 
-bool base64Decode(const String& in, Vector<char>& out, Base64DecodePolicy policy)
+bool base64Decode(const String& in, Vector<char>& out, Base64InvalidCharactersPolicy charactersPolicy, Base64PaddingValidationPolicy paddingPolicy)
 {
     if (in.isEmpty())
-        return base64DecodeInternal<LChar>(0, 0, out, policy);
+        return base64DecodeInternal<LChar>(0, 0, out, charactersPolicy, paddingPolicy);
     if (in.is8Bit())
-        return base64DecodeInternal<LChar>(in.characters8(), in.length(), out, policy);
-    return base64DecodeInternal<UChar>(in.characters16(), in.length(), out, policy);
+        return base64DecodeInternal<LChar>(in.characters8(), in.length(), out, charactersPolicy, paddingPolicy);
+    return base64DecodeInternal<UChar>(in.characters16(), in.length(), out, charactersPolicy, paddingPolicy);
 }
 
 } // namespace WTF