Merge pull request #272 from bumann-sbb/branch-5.0

Added error handling if resumption token is not a valid base64 string

README.md

@@ -68,6 +68,17 @@ mvn spotless:check
 
 ## Release notes
 
+### v5.2.2
+
+#### 🌟 FEATURES
+- (none)
+
+#### 💔 BREAKING CHANGES
+- (none)
+
+#### 🏹 BUG FIXES
+- Catch invalid Base64 encodings for resumption tokens (#272) - a community contribution by @bumann-sbb 💫
+
 ### v5.2.1
 
 #### 🌟 FEATURES

xoai-common/src/main/java/io/gdcc/xoai/services/impl/SimpleResumptionTokenFormat.java

@@ -124,12 +124,16 @@ public String format(ResumptionToken.Value resumptionToken) {
  * @param value The Base64 encoded string
  * @return A decoded String (may be empty)
  */
- static String base64Decode(String value) {
+ static String base64Decode(String value) throws BadResumptionTokenException {
  if (value == null) {
  return null;
  }
- byte[] decodedValue = Base64.getDecoder().decode(value);
- return new String(decodedValue, StandardCharsets.UTF_8);
+ try {
+ byte[] decodedValue = Base64.getDecoder().decode(value);
+ return new String(decodedValue, StandardCharsets.UTF_8);
+ } catch (IllegalArgumentException e) {
+ throw new BadResumptionTokenException("Token has no valid base64 encoding", e);
+ }
  }
 
  static String base64Encode(String value) {

xoai-common/src/test/java/io/gdcc/xoai/services/impl/SimpleResumptionTokenFormatTest.java

@@ -1,6 +1,8 @@
 package io.gdcc.xoai.services.impl;
 
-import static org.junit.jupiter.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import io.gdcc.xoai.exceptions.BadResumptionTokenException;
 import io.gdcc.xoai.model.oaipmh.Granularity;
@@ -68,9 +70,22 @@ void failingParse(String token) {
 
  @ParameterizedTest
  @NullAndEmptySource
- @ValueSource(strings = {" ", "\t\t\t", "offset::1|", "until::2022-05-13T10:00:00Z"})
+ @ValueSource(
+ strings = {
+ " ",
+ "\t\t\t",
+ "offset::1|",
+ "until::2022-05-13T10:00:00Z",
+ "offset::1|set::Ätherische Öle"
+ })
  void validParse(String token) {
  String encoded = SimpleResumptionTokenFormat.base64Encode(token);
  assertDoesNotThrow(() -> format.parse(encoded));
  }
+
+ @ParameterizedTest
+ @ValueSource(strings = {"b2Zmc2V0OjoMDA=", "VG========"})
+ void invalidBase64Parse(String sut) {
+ assertThrows(BadResumptionTokenException.class, () -> format.parse(sut));
+ }
 }