Reject invalid Base64 characters in b64.b64decode()

src/josepy/b64.py

@@ -12,7 +12,12 @@
 """
 
 import base64
-from typing import Union
+import string
+from typing import Final, Union
+
+VALID_B64_CHARS: Final[frozenset[int]] = frozenset(
+    string.ascii_letters.encode("ascii") + string.digits.encode("ascii") + b"-_="
+)
 
 
 def b64encode(data: bytes) -> bytes:
@@ -54,4 +59,7 @@ def b64decode(data: Union[bytes, str]) -> bytes:
     elif not isinstance(data, bytes):
         raise TypeError("argument should be a str or unicode")
 
+    if any(c not in VALID_B64_CHARS for c in data):
+        raise ValueError("argument should contain only valid Base64 characters")
+
     return base64.urlsafe_b64decode(data + b"=" * (4 - (len(data) % 4)))

tests/b64_test.py

@@ -1,6 +1,7 @@
 """Tests for josepy.b64."""
 
 import sys
+import unittest
 from typing import Union
 
 import pytest
@@ -21,7 +22,7 @@
 }
 
 
-class B64EncodeTest:
+class B64EncodeTest(unittest.TestCase):
     """Tests for josepy.b64.b64encode."""
 
     @classmethod
@@ -47,7 +48,7 @@ def test_unicode_fails_with_type_error(self) -> None:
             self._call("some unicode")  # type: ignore
 
 
-class B64DecodeTest:
+class B64DecodeTest(unittest.TestCase):
     """Tests for josepy.b64.b64decode."""
 
     @classmethod
@@ -80,6 +81,14 @@ def test_type_error_no_unicode_or_bytes(self) -> None:
             # We're purposefully testing with the incorrect type here.
             self._call(object())  # type: ignore
 
+    def test_non_urlsafe(self) -> None:
+        with pytest.raises(ValueError):
+            self._call("+/8")
+
+    def test_non_base64_chars(self) -> None:
+        with pytest.raises(ValueError):
+            self._call("*&$")
+
 
 if __name__ == "__main__":
     sys.exit(pytest.main(sys.argv[1:] + [__file__]))  # pragma: no cover