fix: Use strict base64 validation to prevent corrupted saves

Addresses CodeRabbit review feedback:
- Add padding normalization before decoding
- Use validate=True to reject invalid characters instead of silently discarding

This prevents corrupted data from being saved to workspace.
This commit is contained in:
Otto
2026-02-04 22:58:59 +00:00
parent 96ca9daefe
commit 4769a281cc

View File

@@ -114,6 +114,8 @@ def _decode_base64(value: str) -> bytes | None:
try:
if value.startswith("data:"):
value = value.split(",", 1)[1] if "," in value else value
return base64.b64decode(value)
# Normalize padding and use strict validation to prevent corrupted data
padded = value + "=" * (-len(value) % 4)
return base64.b64decode(padded, validate=True)
except (binascii.Error, ValueError):
return None