Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Base64 encoding with non ASCII characters results in ArrayIndexOutOfBoundException #3803

Closed
jerseyrobot opened this issue Apr 9, 2018 · 6 comments

Comments

@jerseyrobot
Copy link
Contributor

To calculate the authentication string in org.glassfish.jersey.client.authentication.BasicAuthenticator the method org.glassfish.jersey.internal.util.Base64.encodeAsString() is used to do the Base64 encoding.
Unfortunately this results in a ArrayIndexOutOfBoundException when the password contains non ASCII characters like § (the paragraph sign) or a German Umlaut.

Some examples:

  • Base64.encodeAsString(new byte[]{(byte)128})
  • Base64.encodeAsString("§")
@jerseyrobot
Copy link
Contributor Author

@mdurawa
Copy link
Contributor

mdurawa commented Apr 24, 2018

The easiest way to fix it, would be to replace org.glassfish.jersey.internal.util.Base64 with java.util.Base64. That would affect about 10 files. (I could try to do that, but I'm not familiar with github yet.)

Btw. in the test classes the behavior not to support bytes > 127 seems to be intended. Is there any reason for that?

@srbala
Copy link

srbala commented May 16, 2018

@mdurawa created a pull request #3829

@mdurawa, I would recommend to deprecate org.glassfish.jersey.internal.util.Base64 not to delete it.

@jansupol
Copy link
Contributor

jansupol commented May 16, 2018

@srbala Why deprecate? The usual contract is that whatever is internal package is not to be used by users, it can be changed/dropped any release...

@srbala
Copy link

srbala commented May 16, 2018

In that case, class can be dropped.

jansupol pushed a commit that referenced this issue Jun 26, 2018
* Replaced core-common.src.main.java.org.glassfish.jersey.internal.util.Base64 with java.util.Base64
* fixed conversion to String after decoding of Base64 encode message
Signed-off-by: Michael Durawa <michael.durawa@boehringer-ingelheim.com>
agherardi pushed a commit to agherardi/jersey-1 that referenced this issue Jul 5, 2018
…ipse-ee4j#3829)

* Replaced core-common.src.main.java.org.glassfish.jersey.internal.util.Base64 with java.util.Base64
* fixed conversion to String after decoding of Base64 encode message
Signed-off-by: Michael Durawa <michael.durawa@boehringer-ingelheim.com>
@maffe
Copy link

maffe commented Sep 7, 2023

This issue can be closed, #3829 was merged, the Base64 class does not exist anymore and a fixed version was released.

@jansupol jansupol closed this as completed Sep 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants