Repository navigation
Conversation
Some base64url consumers (Go's encoding/base64.URLEncoding, Python's urlsafe_b64encode, several JWT and OAuth libraries) require the '=' padding that RFC 4648 section 5 makes optional. Base64Url only ever produced unpadded output, so callers had to append padding by hand or post-process Convert.ToBase64String. Add Base64UrlFormattingOptions with IncludePadding and overloads of the encode methods that take it. Padding goes through the existing tail path via a second encoder struct, so the vectorized loops are unchanged. On the OperationStatus overloads the option applies to the final block only; non-final calls use the unpadded encoder so their destination sizing is unaffected. Value 1 of the enum is left unused so a line break flag could later match Base64FormattingOptions. The overloads live in a file that only CoreLib compiles. The Microsoft.Bcl.Memory net10.0 asset type-forwards Base64Url to a framework without them, so a library compiled against the package's netstandard asset would fail at run time on .NET 10 if the package exposed them. Fix dotnet#129847
dotnet-policy-service
Bot
added
the
community-contribution
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @dotnet/area-system-memory |
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Guarded-buffer coverage remains missing, and the unsafe encoding paths were not built or exercised during this review.
1 open finding
What changed in this PR
Adds opt-in Base64Url padding for interoperability while preserving existing unpadded behavior.
Changes:
- Adds formatting options and encoding overloads.
- Reuses existing encoding helpers, applying padding only to final blocks.
- Adds validation, boundary, streaming, and reference-output tests.
| File | Description |
|---|---|
| src/libraries/System.Runtime/ref/System.Runtime.cs | Declares the new public APIs. |
| src/libraries/System.Private.CoreLib/src/System/Buffers/Text/Base64Url/Base64UrlFormattingOptions.cs | Defines padding options. |
| src/libraries/System.Private.CoreLib/src/System/Buffers/Text/Base64Url/Base64UrlEncoder.Padding.cs | Implements padded encoding overloads and helpers. |
| src/libraries/System.Private.CoreLib/src/System.Private.CoreLib.Shared.projitems | Includes the new implementation files. |
| src/libraries/System.Memory/tests/Base64Url/Base64UrlEncoderUnitTests.cs | Tests padding behavior and error handling. |
🧠 Review effort: Balanced
Comment on lines
+290
to
+292
| public int GetMaxSrcLength(int srcLength, int destLength) => | ||
| srcLength <= MaximumEncodeLength && destLength >= GetPaddedEncodedLength(srcLength) ? | ||
| srcLength : (destLength >> 2) * 3; |
Author
There was a problem hiding this comment.
fixed in ca48546 Add guarded-buffer tests for Base64Url padding
This was referenced Oct 14, 2026
Closed
The padding tests used managed arrays, which cannot catch a read or write past the end of a span. Encode from a BoundedMemory source into BoundedMemory byte and char destinations with a poison page after each, at the scalar and vector block boundaries with 0, 1 and 2 byte tails, using exact-size and one-short destinations and the in-place path. Extend the Base64Url fuzzer with the IncludePadding overloads so continuous fuzzing covers them as well.
This was referenced Oct 15, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
Base64UrlFormattingOptionsand overloads of theBase64Urlencode methods that take it, so callers can emit the=padding that some base64url consumers require (Go'sbase64.URLEncoding, Python'surlsafe_b64encode) instead of appending it by hand or post-processingConvert.ToBase64String. Padding goes through the existing tail path via a second encoder struct, so the vectorized loops are unchanged, and on theOperationStatusoverloads it applies to the final block only. The new API is not exposed through Microsoft.Bcl.Memory: that package's net10.0 asset type-forwardsBase64Urlto a framework without these members, so a netstandard library compiled against the package would fail at run time on .NET 10.Fixes #129847