Treat empty string as invalid base64-string

simplesamlphp · May 2, 2024 · 3b93d1e · 3b93d1e
1 parent 7864461
commit 3b93d1e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/src/CustomAssertionTrait.php b/src/CustomAssertionTrait.php
@@ -115,7 +115,7 @@ private static function stringPlausibleBase64(string $value, string $message = '
             $result = false;
         } else {
             $decoded = base64_decode($value, true);
-            if ($decoded === false) {
+            if (empty($decoded)) { // Invalid _or_ empty string
                 $result = false;
             } elseif (base64_encode($decoded) !== $value) {
                 $result = false;

diff --git a/tests/Assert/Base64Test.php b/tests/Assert/Base64Test.php
@@ -40,6 +40,7 @@ public function testStringPlausibleBase64(bool $shouldPass, string $name): void
     public static function provideBase64(): array
     {
         return [
+            'empty' => [false, ''],
             'valid' => [true, 'U2ltcGxlU0FNTHBocA=='],
             'bogus' => [false, '&*$(#&^@!(^%$'],
             'length not dividable by 4' => [false, 'U2ltcGxlU0FTHBocA=='],