{"record":{"id":"1a36e7c011e0fcb9","repo":"ory/hydra","slug":"base64decode-s","errorCode":null,"errorMessage":"base64decode: %s","messagePattern":"base64decode: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/fetcher/fetcher.go","lineNumber":136,"sourceCode":"func (f *Fetcher) FetchBytes(ctx context.Context, source string) ([]byte, error) {\n\tif !slices.ContainsFunc(f.schemes, func(scheme string) bool {\n\t\treturn strings.HasPrefix(source, scheme+\"://\")\n\t}) {\n\t\treturn nil, errors.WithStack(fmt.Errorf(\"%w: in source %q: allowed schemes: %s\", ErrUnknownScheme, redactedSource(source), strings.Join(f.schemes, \", \")))\n\t}\n\tswitch {\n\tcase strings.HasPrefix(source, \"http://\"), strings.HasPrefix(source, \"https://\"):\n\t\treturn f.fetchRemote(ctx, source)\n\tcase strings.HasPrefix(source, \"file://\"):\n\t\tb, err := os.ReadFile(strings.TrimPrefix(source, \"file://\"))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"read file: %s\", redactedSource(source))\n\t\t}\n\t\treturn b, nil\n\tcase strings.HasPrefix(source, \"base64://\"):\n\t\tsrc, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(source, \"base64://\"))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"base64decode: %s\", redactedSource(source))\n\t\t}\n\t\treturn src, nil\n\tdefault:\n\t\treturn nil, errors.Wrap(ErrUnknownScheme, \"unknown scheme in source: \"+redactedSource(source))\n\t}\n}\n\nfunc (f *Fetcher) fetchRemote(ctx context.Context, source string) (b []byte, err error) {\n\tif f.cache != nil {\n\t\tcacheKey := sha256.Sum256([]byte(source))\n\t\tif v, ok := f.cache.Get(cacheKey[:]); ok {\n\t\t\tb = make([]byte, len(v))\n\t\t\tcopy(b, v)\n\t\t\treturn b, nil\n\t\t}\n\t\tdefer func() {\n\t\t\tif err == nil && len(b) > 0 {\n\t\t\t\ttoCache := make([]byte, len(b))","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/fetcher/fetcher.go#L118-L154","documentation":"For base64:// sources, FetchBytes decodes the remainder of the URI with standard (padded) base64. If the string is not valid StdEncoding base64, the decode error is wrapped with 'base64decode: <redacted source>'.","triggerScenarios":"Calling FetchContext/FetchBytes with base64://<data> where <data> contains URL-safe characters (-, _), is missing padding, or contains whitespace/invalid characters — anything base64.StdEncoding.DecodeString rejects.","commonSituations":"Pasting URL-safe base64 (base64url from JWTs) into a base64:// config value; trimming '=' padding manually; copying base64 with newlines from certificates or editors.","solutions":["Re-encode the payload with standard padded base64: base64.StdEncoding.EncodeToString(data) (use `base64` CLI without -w0/-url flags as appropriate).","If the value is URL-safe base64, convert it (replace - with + and _ with /) and restore '=' padding before storing it.","Strip all whitespace/newlines from the base64 payload in the config value."],"exampleFix":"// before\nsource := \"base64://eyJhbGciOiJIUzI1NiJ9_...\" // URL-safe chars, no padding\n// after\nsource := \"base64://\" + base64.StdEncoding.EncodeToString([]byte(`{\"alg\":\"HS256\"}`))","handlingStrategy":"validation","validationCode":"func validateBase64Source(source string) error {\n\tif !strings.HasPrefix(source, \"base64://\") {\n\t\treturn nil\n\t}\n\tdata := strings.TrimSpace(strings.TrimPrefix(source, \"base64://\"))\n\t_, err := base64.StdEncoding.DecodeString(data)\n\treturn err\n}","typeGuard":"func isStandardBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil\n}","tryCatchPattern":"b, err := f.FetchContext(ctx, source)\nif err != nil && strings.HasPrefix(err.Error(), \"base64decode:\") {\n\tlog.Printf(\"invalid base64 payload in config: %v\", err)\n\tos.Exit(1)\n}","preventionTips":["Generate config values with base64.StdEncoding.EncodeToString, never hand-trim padding.","Convert URL-safe base64 (-, _) to standard base64 before embedding in base64:// URIs.","Strip newlines/whitespace when copying base64 from files or certificates."],"tags":["fetcher","base64","encoding"],"backgroundTag":"invalid-base64-encoding","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}