Base64::decodeUrlSafe() validation is inconsistent

[TimWolla]

In Webauthn\Util\Base64::decodeUrlSafe() the Assertion at the beginning rejects = (i.e. the padding character), but when decoding with the constant time decoder the ::decode() method instead of ::decodeNoPadding() is used. This is inconsistent and requires the decoder to do extra work.

[mayestik1]

I am facing the issue "Invalid Base 64 Url Safe character"
[stacktrace] #0 vendor/beberlei/assert/lib/Assert/Assertion.php(779): Assert\\Assertion::createException() #1 vendor/web-auth/webauthn-lib/src/Util/Base64.php(16): Assert\\Assertion::regex()

Any fixes please?

[Spomky]

Hi @TimWolla,

This is correct, the method Webauthn\Util\Base64::decodeUrlSafe() could be avoided in favor of a direct call to ParagonIE\ConstantTime\Base64::decodeNoPadding().
The framework do it this way because when I started to use this dependency, the available version was 2.4 and this method did not exist (was introduced in 2.6).
I try to keep things working and to avoid BC breaks, I rarely change the dependencies for the same major release. That is why I won't change that for now, but this will be done for the next major version. I will keep track of it for 5.0.0.

Regards.

[TimWolla]

Thanks for the explanation, makes sense.

[Spomky]

@mayestik1

Can you elaborate more on this? What is the input data?

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.