base64 validation too strict; padding is optional

[fluxsauce]

Context

• node version: 6.9.2
• joi version: 10.4.1
• environment node
• used with standalone:
• any other relevant information:

What are you trying to achieve or the steps to reproduce ?

Determine if a URL parameter contains valid base64 encoded content.

const schema = Joi.string().base64()

Example values:

• MTYyMDcxMDozOjE

The problem is that the validation fails on a base64 string that is valid but does not have padding; the issue was dismissed in #1081

I don't agree with that interpretation; it's not invalid, it just doesn't have optional padding.

https://en.wikipedia.org/wiki/Base64#Output_Padding

In theory, the padding character is not needed for decoding, since the number of missing bytes can be calculated from the number of Base64 digits. In some implementations, the padding character is mandatory, while for others it is not used.

The input is not normalized and comes from a variety of sources that I do not have direct control over and I cannot force changes, nor can I just arbitrarily ignore unpadded content.

Attempting to pad the content prior to validation is hacky.

// Joi requires padding.
const paddingLength = working.length % 4;
const workingPadded = paddingLength ? working + '='.repeat(4 - paddingLength) : working;

A more graceful solution would be to make padding optional.

• options: - an optional object with the following optional keys:
  • paddingRequired: if true, requires that the string include = padding. Defaults to true.

Which result you had ?

message: '"value" must be a valid base64 string',

What did you expect ?

No errors.

[Marsup]

Fair enough, happy to take a PR if you're up for it.

[fluxsauce]

I am, as I just got hit with a bug on my end because I didn't apply the padding workaround in all the places that I was validating. :-/

Here's a direct link to the code in question

joi/lib/string.js

Line 409 in 5450404

base64() {

I'm going to fix the code on my end first then try to fix this.

@Marsup do you feel it's better to arbitrarily pad and test or just use a different regex?

[WesTyler]

I would vote for a new regex to test against based on the paddingRequired flag.

[fluxsauce]

I'm cool with that.

[DavidTPate]

In looking at this, I would think that we would make some modifications to our RegExp to make the padding (=) not required but only in the event that the flag paddingRequired is set to false. For backwards compatibility I would expect paddingRequired to default to true.

Definitely happy to take a look at a PR.

[lock]

This thread has been automatically locked due to inactivity. Please open a new issue for related bugs or questions following the new issue template instructions.