spomky-labs / base64url

Base64 URL Safe Encoding/Decoding PHP library

Spomky-Labs

base64url's Issues

Question

the library is used to encode and decode images and documents?

TypeError thrown when decoding invalid value

After upgrading to version 2, the use of strict typing now means that the decode method will throw a TypeError when given nonsense input.

Example:

\Base64Url\Base64Url::decode('cxr0fdsezrewklerewxoz423ocfsa3bw432yjydsa9lhdsalw');

This would previously have returned false as that is what base64_decode is returning, but with the strict type hint for returning a string, this now errors.

I'm not sure if you want to class this as an issue, as it could just be considered a change of behaviour (which I guess is okay since it's a change in a major version), but if this is intended, then perhaps there should be an @throws TypeError added to the docblock to state this explicitly.

Also, there doesn't seem to be any unit tests which test nonsense strings such as the one above, so that might be worth adding.

Base64Url::decode function

Base64Url::decode(string $data) works for some base64 strings but throws invalid data for others.
For example:
It throws invalid data exception for the following strings:
BP0zm+/ZFSYCDt4p51CFCEhpZ0gNySeAJPv3z9rHRsu5/YNlKg5nP3Rhrp6WUt3xdI7GFaZREP3Ld4LYHE26Eyg=
BPqkO1/Lox1q4vWmnAniO4DRcFE0T6EIjPZcjKXvMpKU4TxosZOUPpqQNIUCJxvHsSEWCFKC0fwj7NPlLzC8g94=

and works for following strings:
BCT5o8/IyYueBdumhkt5mQSf35obGPjljxl1ayUzoL0R4UM4Fa2YIrRecKlBUC8ODO309WdpcM3MrwA/ynPh0g0=
BAw3DLU58S2H1JOZBAtYtSuKUi4lVQojO6Av6WRo519gpk1Taxd8BlNeRspM1jEK2MBTemn0jCOJ2l/2MncL98c=

Why the behavior is random? All of the above are valid base64 strings.

Thanks

Wrong handling of minus and spaces in encoding

I use web-token and had problems with some tokens over the weekend, permanently getting 'Unsupported input'.
I found out that the token contained '-' in the signature part of the token.

Digging deeper, I think that Base64Url does not handle '-' and '+' correctly.

Current code:
Encoding: $encoded = strtr(base64_encode($data), '+/', '-_');
Decoding: $decoded = base64_decode(strtr($data, '-_', '+/'), true);

I think the correct version should be:
Encoding: $encoded = strtr(base64_encode($data),['_-', '/+']);
Decoding: $decoded = base64_decode(strtr($data, ['-_', '+/']), true);

I need an official fix for my company project. Could you help on short notice?

Similar module already on Packagist

Similar module already on Packagist with better tests.

Usage of `strstr` for character replacement

I was looking through the source and I saw this:
https://github.com/Spomky-Labs/base64url/blob/master/src/Base64Url.php#L27

It seems like you are using strstr to replace the characters but AFAIK you can't do that with strstr as it is meant to find occurances of substrings. Could you please care to elaborate? I am really interested in what is going on here.