[MONGOCRYPT-304] The base64 url functions in kms_message trim "=" padding from the final output Created: 16/Jan/21  Updated: 28/Oct/23  Resolved: 21/Jan/21

Status: Closed
Project: Libmongocrypt
Component/s: kms_message
Affects Version/s: None
Fix Version/s: 1.2.0

Type: Bug Priority: Major - P3
Reporter: Mark Benvenuto Assignee: Mark Benvenuto
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Depends
is depended on by SERVER-52651 Add FLE support for Azure Closed

 Description   

The functions that convert regular base64 to url safe base64 terminate their loops on '=' which trims the '=' padding from the final output. While the Azure base64 decoder tolerates the missing padding, it is incorrect and was discovered while testing against a python mock server.

See
https://github.com/mongodb/libmongocrypt/blob/master/kms-message/src/kms_b64.c#L522-L524
https://github.com/mongodb/libmongocrypt/blob/master/kms-message/src/kms_b64.c#L556-L558



 Comments   
Comment by Githook User [ 20/Jan/21 ]

Author:

{'name': 'Mark Benvenuto', 'email': 'markbenvenuto@users.noreply.github.com', 'username': 'markbenvenuto'}

Message: MONGOCRYPT-304 Fix base64 URL safe padding (#155)
Branch: master
https://github.com/mongodb/libmongocrypt/commit/ad789a84b7b33ee54a9c0593f1287d22abfd5bb6

Comment by Mark Benvenuto [ 19/Jan/21 ]

Yeah, I see in the RFC
5. Base 64 Encoding with URL and Filename Safe Alphabet:

The pad character "=" is typically percent-encoded when used in an
URI [9], but if the data length is known implicitly, this can be
avoided by skipping the padding; see section 3.2.

3.2. Padding of Encoded Data

In some circumstances, the use of padding ("=") in base-encoded data
is not required or used. In the general case, when assumptions about
the size of transported data cannot be made, padding is required to
yield correct decoded data.

Implementations MUST include appropriate pad characters at the end of
encoded data unless the specification referring to this document
explicitly states otherwise.

The base64 and base32 alphabets use padding, as described below in
sections 4 and 6, but the base16 alphabet does not need it; see
section 8.

Generated at Thu Feb 08 09:08:25 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.