{"record":{"id":"15ff51b085cded57","repo":"spring-projects/spring-security","slug":"failed-to-deserialize-payload-15ff51","errorCode":null,"errorMessage":"Failed to deserialize payload","messagePattern":"Failed to deserialize payload","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/OpenSaml5Template.java","lineNumber":160,"sourceCode":"\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}\n\t\tcatch (MarshallingException ex) {\n\t\t\tthrow new Saml2Exception(ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(Element element) {\n\t\treturn new OpenSaml5SerializationConfigurer(element);","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/OpenSaml5Template.java#L142-L178","documentation":"This is the catch-all in OpenSaml5Template.deserialize(): any non-Saml2Exception failure while parsing/unmarshalling the payload (ParserPool parse errors, SAX/IO problems, unmarshalling failures) is wrapped in a Saml2Exception with the original as cause. It signals the serialized XML could not be turned into an OpenSAML object.","triggerScenarios":"Calling OpenSaml5Template.deserialize(String) where pool.parse(serialized) or unmarshaller.unmarshall(element) throws any Exception other than Saml2Exception (malformed XML, encoding issues, schema violations during unmarshalling, IO errors).","commonSituations":"Passing URL-encoded or Base64 data that was not first decoded; XML with invalid characters or mismatched tags; payloads altered in transit (whitespace/signature wrapping breaking parsing); wrong charset causing parse failures.","solutions":["Inspect the wrapped cause (ex.getCause()) to find the underlying parser/unmarshaller error.","Verify the input string is plain XML, not Base64- or URL-encoded, before calling deserialize().","Validate the XML well-formedness with a standalone parser to isolate the malformed portion.","Confirm the SAML message was not truncated or modified in transit (check relay/proxy handling and request parameter decoding, e.g. use URLDecoder and the correct charset)."],"exampleFix":"// before\nString encoded = request.getParameter(\"SAMLResponse\");\nResponse r = template.deserialize(encoded); // still base64\n\n// after\nString decoded = new String(Base64.getMimeDecoder().decode(request.getParameter(\"SAMLResponse\")), StandardCharsets.UTF_8);\nResponse r = template.deserialize(decoded);","handlingStrategy":"try-catch","validationCode":"try { DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(new StringReader(serialized))); } catch (Exception e) { throw new IllegalArgumentException(\"Malformed XML payload\", e); }","typeGuard":null,"tryCatchPattern":"try { return template.deserialize(serialized); } catch (Saml2Exception ex) { log.error(\"Payload deserialization failed; cause={}\", ex.getCause(), ex); throw ex; }","preventionTips":["Always inspect ex.getCause() for the underlying parser error","Ensure proper Base64/URL decoding with correct charset before deserialize()","Log a sanitized snippet of the payload to catch truncation/encoding issues"],"tags":["saml","opensaml","xml-parsing","spring-security","deserialization"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}