Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle invalid base64 in SRI #23410

Closed

Conversation

benjaminp
Copy link
Collaborator

Previously, invalid base64 would crash the Bazel server.

@github-actions github-actions bot added team-ExternalDeps External dependency handling, remote repositiories, WORKSPACE file. awaiting-review PR is awaiting review from an assigned reviewer labels Aug 22, 2024
try {
return Base64.getDecoder().decode(data);
} catch (IllegalArgumentException e) {
throw new InvalidChecksumException("Invalid base64 " + data, e);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
throw new InvalidChecksumException("Invalid base64 " + data, e);
throw new InvalidChecksumException("Invalid base64: " + data, e);

Clarifies where the invalid base64 starts as it might be very invalid.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will put the value in quotes since that's what the other error messages in this file do.

Previously, invalid base64 would crash the Bazel server.
Copy link
Member

@meteorcloudy meteorcloudy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix!

@meteorcloudy meteorcloudy added awaiting-PR-merge PR has been approved by a reviewer and is ready to be merge internally and removed awaiting-review PR is awaiting review from an assigned reviewer labels Aug 26, 2024
@fmeum
Copy link
Collaborator

fmeum commented Aug 26, 2024

@bazel-io fork 7.4.0

@github-actions github-actions bot removed the awaiting-PR-merge PR has been approved by a reviewer and is ready to be merge internally label Aug 26, 2024
bazel-io pushed a commit to bazel-io/bazel that referenced this pull request Aug 26, 2024
Previously, invalid base64 would crash the Bazel server.

Closes bazelbuild#23410.

PiperOrigin-RevId: 667624565
Change-Id: I7b6b834fd291e9a3dae59df88b29bb378e7663a3
@benjaminp benjaminp deleted the checksum-invalid-base64 branch August 26, 2024 17:31
github-merge-queue bot pushed a commit that referenced this pull request Aug 27, 2024
Previously, invalid base64 would crash the Bazel server.

Closes #23410.

PiperOrigin-RevId: 667624565
Change-Id: I7b6b834fd291e9a3dae59df88b29bb378e7663a3

Commit
1b0ed28

---------

Co-authored-by: Benjamin Peterson <[email protected]>
Co-authored-by: Yun Peng <[email protected]>
@iancha1992
Copy link
Member

The changes in this PR have been included in Bazel 7.4.0 RC1. Please test out the release candidate and report any issues as soon as possible.
If you're using Bazelisk, you can point to the latest RC by setting USE_BAZEL_VERSION=7.4.0rc1. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
team-ExternalDeps External dependency handling, remote repositiories, WORKSPACE file.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants