GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-125346: Fix decoding with non-standard Base64 alphabet by serhiy-storchaka · Pull Request #141128 · python/cpython

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented Nov 6, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

The "+" and "/" characters are no longer recognized as the part of the Base64 alphabet in base64.urlsafe_b64decode() and base64.b64decode() the altchars argument that does not contain them.

  • Issue: Base64 decode with altchars still accepts non-altchars #125346

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead reacted with heart emoji
All reactions
  • ❤️ 1 reaction
@serhiy-storchaka
pythongh-141061: Fix decoding with non-standard Base64 alphabet
591127b 
The "+" and "/" characters are no longer recognized as the part of
the Base64 alphabet in base64.urlsafe_b64decode() and base64.b64decode()
the altchars argument that does not contain them.
@serhiy-storchaka
serhiy-storchaka requested a review from sethmlarson November 6, 2025 10:07
@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Nov 6, 2025
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 6, 2025
@sethmlarson

sethmlarson commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

@serhiy-storchaka Thanks for this, can you link this PR to either the original issue or a new issue for tracking purposes.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson
sethmlarson reviewed Nov 6, 2025
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm really concerned about the subtle breakages that this change could cause, especially because the default behavior is to throw away characters that aren't in the current alphabet. If the default behavior was to raise an error I would feel better about this change.

Makes me wonder if we should target validate=True with this behavior change (because IMO, the silent dropping of invalid characters is in itself a concerning behavior) and then long-term move to having validate be enabled by default?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
sethmlarson
sethmlarson reviewed Nov 6, 2025
View reviewed changes
Comment thread Lib/test/test_base64.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
Fix the issue number.
5c1e8d4
@serhiy-storchaka serhiy-storchaka changed the title gh-141061: Fix decoding with non-standard Base64 alphabet gh-125346: Fix decoding with non-standard Base64 alphabet Nov 6, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Nov 6, 2025
Base64 decode with altchars still accepts non-altchars #125346
Closed
serhiy-storchaka added 3 commits November 6, 2025 17:47
@serhiy-storchaka
Remove unrelated changes.
b0d5877
@serhiy-storchaka
Merge branch 'main' into b64decode-altchars
15b39c5
@serhiy-storchaka
Only emit a warning if validate=False.
414e4ac
serhiy-storchaka
serhiy-storchaka commented Nov 6, 2025
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This worries me too. We can keep the old behavior but emit a warning if characters + or / occur in Base64 data with the alternative alphabet.

But urlsafe_b64decode() does not have the validate parameter.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
Comment thread Lib/test/test_base64.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
serhiy-storchaka marked this pull request as draft November 7, 2025 08:20
@bedevere-app bedevere-app Bot removed the awaiting core review label Nov 7, 2025
@sethmlarson

sethmlarson commented Nov 7, 2025

Copy link
Copy Markdown
Contributor

But urlsafe_b64decode() does not have the validate parameter.

I wonder if for urlsafe_b64decode() it is okay to error out on bad characters as the function name is more clear that this is for a specific base64 alphabet?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka

serhiy-storchaka commented Nov 7, 2025

Copy link
Copy Markdown
Member Author

But is not passing altchars to b64decode() also makes it clear that it uses a different alphabet?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson

sethmlarson commented Nov 12, 2025

Copy link
Copy Markdown
Contributor

@serhiy-storchaka Yes maybe you're right that using altchars is enough that users should be expecting the alphabet to completely shift. I did some poking around with libraries that use altchars with b64decode() and found comments that confirm your thinking. Maybe that's a vote for moving to always erroring in case a non-alphabet value is supplied?
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
serhiy-storchaka added 3 commits November 13, 2025 23:42
@serhiy-storchaka
Merge branch 'main' into b64decode-altchars
f5d1932
@serhiy-storchaka
Merge branch 'main' into b64decode-altchars
0c8fe51
@serhiy-storchaka
Make validate=True by default in base64.b64decode().
db32b32
@serhiy-storchaka serhiy-storchaka removed needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Nov 22, 2025
@serhiy-storchaka

serhiy-storchaka commented Nov 22, 2025

Copy link
Copy Markdown
Member Author

If this is only for 3.15, then making validate=True by default will make the code more reliable by default.
gpshead reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@serhiy-storchaka
serhiy-storchaka marked this pull request as ready for review November 22, 2025 17:07
@serhiy-storchaka
serhiy-storchaka requested a review from AA-Turner as a code owner November 22, 2025 17:07
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 22, 2025
@serhiy-storchaka
Merge branch 'main' into b64decode-altchars
2b75653
serhiy-storchaka added 2 commits January 18, 2026 11:12
@serhiy-storchaka
Revert "Make validate=True by default in base64.b64decode()."
e9db343 
This reverts commit db32b32.
@serhiy-storchaka
Always only emit a warning.
220fc4e
sethmlarson
sethmlarson approved these changes Jan 20, 2026
View reviewed changes
@sethmlarson
sethmlarson requested review from gpshead and zooba January 20, 2026 22:06
@serhiy-storchaka
serhiy-storchaka merged commit 9060b4a into python:main Jan 21, 2026
47 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting core review label Jan 21, 2026
@serhiy-storchaka
serhiy-storchaka deleted the b64decode-altchars branch January 21, 2026 07:42
@Viicos Viicos mentioned this pull request Feb 6, 2026
test_base64url[Base64UrlBytes-bytes-alphabet-vanilla] throws a warning with Python 3.15 pydantic/pydantic#12778
Closed
1 task done
thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026
@serhiy-storchaka @thunder-coding
pythongh-125346: Deprecate accepting standard Base64 alphabet when al…
41b3d35 
…ternative alphabet is used (pythonGH-141128)

Emit a warning in base64.urlsafe_b64decode() and base64.b64decode() when
the "+" or "/" characters occur in the Base64 data with alternative
alphabet if they are not the part of the alternative alphabet.

It is a DeprecationWarning in the strict mode (will be error) and
a FutureWarning in non-strict mode (will be ignored).
@mayeut

mayeut commented Mar 14, 2026

Copy link
Copy Markdown
Contributor

Sorry to comment on a merged pull request but I'd rather ask the question here before opening an issue:

The altchars len validation moved from a simple assert to a ValueError. While I think it makes sense it's not being documented as being changed. Should it be ?
This also makes the check in the encode function to now behave differently (still the simple assert) which lacks consistency:

cpython/Lib/base64.py

Line 61 in 77c06f3

assert len(altchars) == 2, repr(altchars)

Does either of this concerns make sense ? If so I'll open a new issue.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead

gpshead commented Mar 15, 2026

Copy link
Copy Markdown
Member

feel free to open a new PR referencing the same issue for little cleanup followups like that. We don't need to document ValueError or document that one as that is a normal error response to an API not being used quite right.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cdce8p cdce8p mentioned this pull request Mar 31, 2026
testAllBase64Features_librt fails with Python 3.14.4 python/mypy#21120
Closed
@cdce8p cdce8p mentioned this pull request Apr 16, 2026
Initial support for Python 3.15.0a8 python/mypy#21255
Merged
hauntsaninja pushed a commit to python/mypy that referenced this pull request Apr 16, 2026
@cdce8p
Initial support for Python 3.15.0a8 (#21255)
ebaa73a 
Some minor changes to be able to compile mypy with mypyc on Python
3.15.0a8.

- Update `typing-extensions` to `>=4.14.0` for Python `>=3.15` due to
the removal of `typing.no_type_check_decorator`
python/cpython#133601

https://docs.python.org/3/library/typing.html#typing.no_type_check_decorator
https://github.com/python/typing_extensions/blob/4.14.0/CHANGELOG.md
- `TypeAliasType.__qualname__` was added in
python/cpython#139817
- Some new FutureWarnings for b64_decode
python/cpython#125346
python/cpython#141128
JukkaL pushed a commit to python/mypy that referenced this pull request Apr 21, 2026
@cdce8p @JukkaL
Initial support for Python 3.15.0a8 (#21255)
ba28610 
Some minor changes to be able to compile mypy with mypyc on Python
3.15.0a8.

- Update `typing-extensions` to `>=4.14.0` for Python `>=3.15` due to
the removal of `typing.no_type_check_decorator`
python/cpython#133601

https://docs.python.org/3/library/typing.html#typing.no_type_check_decorator
https://github.com/python/typing_extensions/blob/4.14.0/CHANGELOG.md
- `TypeAliasType.__qualname__` was added in
python/cpython#139817
- Some new FutureWarnings for b64_decode
python/cpython#125346
python/cpython#141128
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sethmlarson sethmlarson sethmlarson approved these changes
@AA-Turner AA-Turner Awaiting requested review from AA-Turner AA-Turner is a code owner
@zooba zooba Awaiting requested review from zooba
@gpshead gpshead Awaiting requested review from gpshead

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@serhiy-storchaka @sethmlarson @mayeut @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.