[
https://issues.apache.org/jira/browse/THRIFT-6156?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dmytro Shteflyuk resolved THRIFT-6156.
--------------------------------------
Fix Version/s: 0.25.0
Resolution: Fixed
> Ruby JsonProtocol leaks ArgumentError for malformed Base64 data
> ---------------------------------------------------------------
>
> Key: THRIFT-6156
> URL: https://issues.apache.org/jira/browse/THRIFT-6156
> Project: Thrift
> Issue Type: Bug
> Components: Ruby - Library
> Reporter: Dmytro Shteflyuk
> Assignee: Dmytro Shteflyuk
> Priority: Major
> Fix For: 0.25.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> h3. Problem
> Ruby's {{JsonProtocol#read_json_base64}} decodes JSON binary values with
> strict Base64 decoding. When the wire value contains an invalid alphabet or
> invalid padding, Ruby's {{ArgumentError}} escapes directly instead of being
> translated into a typed Thrift protocol exception.
> h3. Client impact
> Ruby clients and servers cannot handle malformed JSON binary values through
> the normal Thrift protocol-error path. When this occurs while a processor is
> reading method arguments, the implementation exception can be treated as a
> generic application failure rather than invalid protocol data, producing
> inconsistent diagnostics and error handling.
> h3. Reproduction
> {code:language=bash}
> cd lib/rb
> bundle exec ruby -Ilib -e 'require "thrift"; protocol =
> Thrift::JsonProtocol.new(Thrift::MemoryBufferTransport.new(%q{"%"})); begin;
> protocol.read_json_base64; rescue => error; warn "#{error.class}:
> #{error.message}"; end'
> {code}
> Testing on master commit {{04c87e89ae25e759123b942d2d73e4cc3415c948}}
> produces:
> {code}
> ArgumentError: invalid base64
> {code}
> h3. Expected behavior
> Malformed Base64 in a JSON binary value should raise {{ProtocolException}}
> with type {{INVALID_DATA}}, consistently with other invalid JSON protocol
> data. Valid Base64, including the currently supported optional padding,
> should continue to decode unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
