Title: Excess Base64 data ignored after padding by default · Issue #145264 · python/cpython · GitHub
Open Graph Title: Excess Base64 data ignored after padding by default · Issue #145264 · python/cpython
X Title: Excess Base64 data ignored after padding by default · Issue #145264 · python/cpython
Description: Bug report After adding the ignorechars parameter for the Base64 decoder (see #144001), decoding in non-strict mode is almost equivalent to decoding with ignorechars including all characters. Except for one detail -- in non-strict mode t...
Open Graph Description: Bug report After adding the ignorechars parameter for the Base64 decoder (see #144001), decoding in non-strict mode is almost equivalent to decoding with ignorechars including all characters. Excep...
X Description: Bug report After adding the ignorechars parameter for the Base64 decoder (see #144001), decoding in non-strict mode is almost equivalent to decoding with ignorechars including all characters. Excep...
Opengraph URL: https://github.com/python/cpython/issues/145264
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Excess Base64 data ignored after padding by default","articleBody":"# Bug report\n\nAfter adding the `ignorechars` parameter for the Base64 decoder (see #144001), decoding in non-strict mode is almost equivalent to decoding with `ignorechars` including all characters. Except for one detail -- in non-strict mode the first valid padding stops decoding. Any following data is silently ignored. This leads to issues like #137687.\n\nThis contradicts [RFC 4648, section 3.3](https://datatracker.ietf.org/doc/html/rfc4648#section-3.3) which only allows to _ignore_ the pad character if it is present before the end of the encoded data.\n\n\u003e Furthermore, such specifications MAY ignore the pad\n\u003e character, \"=\", treating it as non-alphabet data, if it is present\n\u003e before the end of the encoded data. If more than the allowed number\n\u003e of pad characters is found at the end of the string (e.g., a base 64\n\u003e string terminated with \"===\"), the excess pad characters MAY also be\n\u003e ignored.\n\n`b'YW==Jj'` and `b'YWJ=j'` should be decoded to `b'abc'`, not to `b'a'` or `b'ab'`.\n\nSo, how are we going to fix this issue? We can simply change the behavior by default -- this may be a breaking change, but it is a bugfix, it breaks incorrect behavior. We can start long process of emitting a FutureWarning, and then changing the behavior few releases later. We can add a new option to alter the behavior and start emitting a FutureWarning by default.\n\nIn 3.15+ we can simply pass the `ignorechars` argument to enable RFC 4648 complaining lenient behavior. The question is about the default behavior.\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-145267\n* gh-146326\n* gh-146348\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/serhiy-storchaka","@type":"Person","name":"serhiy-storchaka"},"datePublished":"2026-02-26T16:02:25.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":10},"url":"https://github.com/145264/cpython/issues/145264"}
| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:aa32d1e2-db4f-9a08-f1e4-f9c6c7a03fee |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | C240:10637F:22DFADE:2E6E814:6A520237 |
| html-safe-nonce | ac6fb5bf44bf5401d6fd212f04fc9c7c31c3d3bc8cfb82acfa5790d9710bd412 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDMjQwOjEwNjM3RjoyMkRGQURFOjJFNkU4MTQ6NkE1MjAyMzciLCJ2aXNpdG9yX2lkIjoiNzc4MTI1ODUxNDcwMjQwMjEwMyIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | e4d0648256e6d88fd4be5f2ad7ca74994eb925adeebf2bef1907ec01cd39ee05 |
| hovercard-subject-tag | issue:3996377853 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/python/cpython/145264/issue_layout |
| twitter:image | https://opengraph.githubassets.com/1119edcdd894cfe5119cf635067aa93022a79131ca2a6ce502d73406d5cf7e38/python/cpython/issues/145264 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/1119edcdd894cfe5119cf635067aa93022a79131ca2a6ce502d73406d5cf7e38/python/cpython/issues/145264 |
| og:image:alt | Bug report After adding the ignorechars parameter for the Base64 decoder (see #144001), decoding in non-strict mode is almost equivalent to decoding with ignorechars including all characters. Excep... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | serhiy-storchaka |
| hostname | github.com |
| expected-hostname | github.com |
| None | b9a586c06a05a7a86fc7e3f4dbd03e42f6869085879aa184aa6369456dbd50fb |
| turbo-cache-control | no-preview |
| go-import | github.com/python/cpython git https://github.com/python/cpython.git |
| octolytics-dimension-user_id | 1525981 |
| octolytics-dimension-user_login | python |
| octolytics-dimension-repository_id | 81598961 |
| octolytics-dimension-repository_nwo | python/cpython |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 81598961 |
| octolytics-dimension-repository_network_root_nwo | python/cpython |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 7aed05249554b889eb33d002851a973eebcc7e91 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width