Reject malformed Base64 padding in bytes loaders

docs/changelog/fragments/+strict_base64.bugfix.rst

@@ -0,0 +1 @@
+Reject leading and excess padding when loading Base64-encoded bytes-like values.

src/adaptix/_internal/morphing/concrete_provider.py

@@ -275,6 +275,7 @@ def provide_json_schema(self, mediator: Mediator, request: JSONSchemaRequest) ->
 
 
 B64_PATTERN = re.compile(b"[A-Za-z0-9+/]*={0,2}")
+BAD_BASE64_STRING = "Bad base64 string"
 
 
 @for_predicate(bytes)
@@ -288,9 +289,18 @@ def bytes_base64_loader(data):
                 encoded = data.encode("ascii")
             except AttributeError:
                 raise TypeLoadError(str, data)
+            except UnicodeEncodeError:
+                raise ValueLoadError(BAD_BASE64_STRING, data)
 
             if not B64_PATTERN.fullmatch(encoded):
-                raise ValueLoadError("Bad base64 string", data)
+                raise ValueLoadError(BAD_BASE64_STRING, data)
+            if b"=" in encoded:
+                # a2b_base64 accepts leading and excess padding, so reject padding
+                # beyond the amount implied by the unpadded data length first.
+                unpadded = encoded.rstrip(b"=")
+                padding_length = len(encoded) - len(unpadded)
+                if not unpadded or padding_length > -len(unpadded) % 4:
+                    raise ValueLoadError(BAD_BASE64_STRING, data)
 
             try:
                 return a2b_base64(encoded)

tests/unit/morphing/test_concrete_provider.py

@@ -353,12 +353,20 @@ def test_bytes_like_provider(
     b64_string = b"YWJjZA=="
 
     assert get_string(loader(b64_string.decode())) == string
+    assert get_string(loader("")) == ""
+    assert get_string(loader("YQ==")) == "a"
+    assert get_string(loader("YWI=")) == "ab"
 
     raises_exc(
         ValueLoadError("Bad base64 string", "Hello, world"),
         lambda: loader("Hello, world"),
     )
 
+    raises_exc(
+        ValueLoadError("Bad base64 string", "🦄"),
+        lambda: loader("🦄"),
+    )
+
     raises_exc(
         ValueLoadError(
             msg="Invalid base64-encoded string: number of data characters (5) cannot be 1 more than a multiple of 4",
@@ -372,6 +380,18 @@ def test_bytes_like_provider(
         lambda: loader("YWJjZA"),
     )
 
+    for invalid_base64 in (
+        "=",
+        "==",
+        "AAA==",
+        "AAAA=",
+        "AAAA==",
+    ):
+        raises_exc(
+            ValueLoadError("Bad base64 string", invalid_base64),
+            lambda invalid_base64=invalid_base64: loader(invalid_base64),
+        )
+
     raises_exc(
         TypeLoadError(str, 108),
         lambda: loader(108),