Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[7.x](backport #27311) Fix: Allow non-padded base64 data to be decoded by decode_base64_field #27554

Merged
merged 1 commit into from
Aug 24, 2021

Commits on Aug 23, 2021

  1. Allow non-padded base64 data to be decoded by decode_base64_field (#2…

    …7311)
    
    ## What does this PR do?
    
    This change allows the decoding of any raw base64 input strings that were previously encoded without standard padding character (`=`).
    
    By stripping the padding, we can use `base64.RawStdEncoding.DecodeString` to decode the base64 string. This is easier than appending the padding characters.
    
    Another attempt to fix this has been made in #25817, but that PR has been closed.
    
    ## Why is it important?
    
    When attempting to decode the payload (middle) section of a JWT token, it was discovered that the decode was failing, because padding characters are not included in a JWT token string. Padding is not required in base64, so it makes sense to allow to decode both unpadded and padded strings.
    
    Currently, there is a workaround for some beats by appending the `=`-signs in a javascript processor, but that isn't available in all beats and is an ugly workaround anyway. See https://medium.com/@guyromb/decode-jwt-traefik-access-logs-using-filebeat-95d935eb7c4f
    
    Co-authored-by: Adrian Serrano <adrisr83@gmail.com>
    (cherry picked from commit 9c4f7f9)
    michaelarnauts authored and mergify-bot committed Aug 23, 2021
    Configuration menu
    Copy the full SHA
    b2e810f View commit details
    Browse the repository at this point in the history