24 lines
626 B
Go
24 lines
626 B
Go
package auth
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"errors"
|
|
"strings"
|
|
)
|
|
|
|
// Bound allocation before decoding and reject non-canonical encodings, including
|
|
// CR/LF (which encoding/base64 accepts even in Strict mode).
|
|
func decodeBase64(s string, encoding *base64.Encoding, maxBytes int) ([]byte, error) {
|
|
if len(s) > encoding.EncodedLen(maxBytes) || strings.ContainsAny(s, "\r\n") {
|
|
return nil, errors.New("invalid base64 length or whitespace")
|
|
}
|
|
b, err := encoding.Strict().DecodeString(s)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if len(b) > maxBytes {
|
|
return nil, errors.New("decoded value exceeds limit")
|
|
}
|
|
return b, nil
|
|
}
|