{"record":{"id":"1ddc1e9e12094676","repo":"spring-projects/spring-security","slug":"unable-to-deflate-string-1ddc1e","errorCode":null,"errorMessage":"Unable to deflate string","messagePattern":"Unable to deflate string","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java","lineNumber":63,"sourceCode":"\n\tstatic String samlEncode(byte[] b) {\n\t\treturn Base64.getEncoder().encodeToString(b);\n\t}\n\n\tstatic byte[] samlDecode(String s) {\n\t\treturn Base64.getMimeDecoder().decode(s);\n\t}\n\n\tstatic byte[] samlDeflate(String s) {\n\t\ttry {\n\t\t\tByteArrayOutputStream b = new ByteArrayOutputStream();\n\t\t\tDeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));\n\t\t\tdeflater.write(s.getBytes(StandardCharsets.UTF_8));\n\t\t\tdeflater.finish();\n\t\t\treturn b.toByteArray();\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to deflate string\", ex);\n\t\t}\n\t}\n\n\tstatic String samlInflate(byte[] b) {\n\t\ttry {\n\t\t\tByteArrayOutputStream out = new ByteArrayOutputStream();\n\t\t\tInflaterOutputStream iout = new InflaterOutputStream(out, new Inflater(true));\n\t\t\tiout.write(b);\n\t\t\tiout.finish();\n\t\t\treturn new String(out.toByteArray(), StandardCharsets.UTF_8);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to inflate string\", ex);\n\t\t}\n\t}\n\n\tstatic EncodingConfigurer withDecoded(String decoded) {\n\t\treturn new EncodingConfigurer(decoded);","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java#L45-L81","documentation":"Saml2Utils.samlDeflate compresses a string using a raw (nowrap) DEFLATE stream, as required for SAML HTTP-Redirect binding; any IOException during compression is wrapped in this Saml2Exception. Because the underlying stream is an in-memory ByteArrayOutputStream, this is essentially a defensive wrapper for the checked IOException rather than an input-driven failure.","triggerScenarios":"Calling Saml2Utils.samlDeflate(String) when DeflaterOutputStream.write/finish throws IOException — realistically only under JVM-level failures such as memory exhaustion during buffer growth, since the stream is in-memory and cannot fail on bad input.","commonSituations":"Redirect-binding request construction failing unexpectedly; the exception surfacing alongside OutOfMemoryError or other JVM resource problems; seeing it in tests after refactoring the stream implementation.","solutions":["Inspect ex.getCause() for the real I/O failure; the input string content itself cannot cause this error.","Check JVM memory/resource pressure (heap dumps, nearby OutOfMemoryError) if it reproduces.","Retry the operation — only transient JVM-level failures are a realistic trigger.","If persistent, replace with an equivalent raw-DEFLATE utility or file a bug with a reproducer."],"exampleFix":"// before\nbyte[] deflated = Saml2Utils.samlDeflate(hugeString); // memory pressure -> Saml2Exception: Unable to deflate string\n// after\nbyte[] deflated = Saml2Utils.samlDeflate(normalSizedXml);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    byte[] deflated = Saml2Utils.samlDeflate(xml);\n} catch (Saml2Exception ex) {\n    logger.error(\"Deflate failed (JVM-level I/O error)\", ex.getCause());\n    throw new IllegalStateException(\"SAML compression failed\", ex);\n}","preventionTips":["Remember this failure is JVM-level, not input-driven — investigate cause first.","Watch heap/memory pressure when compressing very large messages.","Retry once on transient failures.","Keep SAML messages small; avoid embedding huge attributes."],"tags":["saml2","deflate","redirect-binding","compression"],"backgroundTag":"compression-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}