{"record":{"id":"49d53c4bfc7e4846","repo":"spring-projects/spring-security","slug":"unable-to-inflate-string","errorCode":null,"errorMessage":"Unable to inflate string","messagePattern":"Unable to inflate string","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java","lineNumber":74,"sourceCode":"\t\t\tdeflater.write(s.getBytes(StandardCharsets.UTF_8));\n\t\t\tdeflater.finish();\n\t\t\treturn b.toByteArray();\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to deflate string\", ex);\n\t\t}\n\t}\n\n\tstatic String samlInflate(byte[] b) {\n\t\ttry {\n\t\t\tByteArrayOutputStream out = new ByteArrayOutputStream();\n\t\t\tInflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));\n\t\t\tiout.write(b);\n\t\t\tiout.finish();\n\t\t\treturn new String(out.toByteArray(), StandardCharsets.UTF_8);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to inflate string\", ex);\n\t\t}\n\t}\n\n\tstatic EncodingConfigurer withDecoded(String decoded) {\n\t\treturn new EncodingConfigurer(decoded);\n\t}\n\n\tstatic DecodingConfigurer withEncoded(String encoded) {\n\t\treturn new DecodingConfigurer(encoded);\n\t}\n\n\tstatic final class EncodingConfigurer {\n\n\t\tprivate final String decoded;\n\n\t\tprivate boolean deflate;\n\n\t\tprivate EncodingConfigurer(String decoded) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java#L56-L92","documentation":"Saml2Utils.samlInflate decompresses a DEFLATE-encoded SAML message received via HTTP-Redirect binding. This Saml2Exception is thrown when decompression fails (IOException), typically because the bytes are not raw-DEFLATE data or exceed the CappedOutputStream size limit wrapped inside the stream.","triggerScenarios":"samlInflate(byte[] b) writes to an InflaterOutputStream over a CappedOutputStream; corrupt/truncated/zlib-headed (not raw) deflate data, or payload exceeding MAX_SIZE, causes IOException and the \"Unable to inflate string\" Saml2Exception.","commonSituations":"IdP sends zlib-wrapped or gzip compression instead of raw DEFLATE; SAML message tampered or truncated in transit; redirect URL decoding (Base64) performed incorrectly before inflation; hostile oversized payload hitting the size cap.","solutions":["Verify the message is Base64-decoded correctly before calling samlInflate","Confirm the IdP uses raw DEFLATE (no zlib header) for redirect binding; fix IdP config if not","Log the wrapped cause to distinguish corruption vs size-cap and re-request the assertion via POST binding instead","Check payload size against MAX_SIZE — oversized responses must be delivered via POST binding"],"exampleFix":"// before\n byte[] raw = Base64.getUrlDecoder().decode(samlParam);\n String xml = Saml2Utils.samlInflate(raw); // fails: double-decoded or zlib data\n// after\n byte[] raw = Base64.getDecoder().decode(samlParam); // decode exactly once\n String xml = Saml2Utils.samlInflate(raw);","handlingStrategy":"try-catch","validationCode":"// decode once, verify Base64 before inflating\nbyte[] raw;\ntry { raw = Base64.getDecoder().decode(b64); }\ncatch (IllegalArgumentException e) { return null; }\nif (raw.length > MAX_EXPECTED_COMPRESSED) return null;","typeGuard":null,"tryCatchPattern":"try {\n    String xml = Saml2Utils.samlInflate(raw);\n} catch (Saml2Exception e) {\n    // likely corrupt/non-raw-deflate input or size cap; log and reject request\n}","preventionTips":["Base64-decode exactly once with the correct decoder","Confirm IdP uses raw DEFLATE (not zlib/gzip) for redirect binding","Fall back to POST binding for large messages","Inspect the cause to distinguish corruption from decompression bombs"],"tags":["saml2","inflate","compression"],"backgroundTag":"compression-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}