Module: Ruby::Rego::Builtins::Base64Url

Defined in:
lib/ruby/rego/builtins/base64url.rb

Overview

URL-safe base64 decoding shared by base64url.decode and io.jwt.decode’s segments, matching Go’s base64.URLEncoding: missing ‘=’ padding is restored, but the standard-base64 ‘+’/’/’ alphabet and a non-canonical ‘=’ (one that doesn’t complete a 4-char block) are rejected, so an input OPA treats as undefined stays un-decodable here too. strict_decode raises ArgumentError on rejected input; callers map that to undefined.

Gem-more-strict divergence (safe direction, crafted input only): Base64.urlsafe_decode64 strict- decodes, rejecting a final base64url character whose unused low bits are non-zero (e.g. a 2-char “AB”), whereas Go masks those bits and decodes. The gem is undefined where OPA would decode; canonical encoders never emit such input, so real values are unaffected.

Class Method Summary collapse

Class Method Details

.strict_decode(string) ⇒ String

Returns the decoded bytes.

Parameters:

  • string (String)

Returns:

  • (String) —

    the decoded bytes

Raises:

  • (ArgumentError) —

    when the string is not canonical URL-safe base64



22
23
24
25
26
 
# File 'lib/ruby/rego/builtins/base64url.rb', line 22

def self.strict_decode(string)
  raise ArgumentError, "standard base64 character" if string.match?(%r{[+/]})

  Base64.urlsafe_decode64(restore_padding(string))
end