{"record":{"id":"4e4fb459211cc673","repo":"alibaba/nacos","slug":"illegal-base64-character-c","errorCode":null,"errorMessage":"Illegal base64 character: '{c}'","messagePattern":"Illegal base64 character: '(.+?)'","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/Base64Decode.java","lineNumber":130,"sourceCode":"            // Decode last 1-3 bytes (incl '=') into 1-3 bytes\n            int i = 0;\n            for (int j = 0; sIx <= eIx - pad; j++) {\n                i |= ctoi(sArr[sIx++]) << (18 - j * 6);\n            }\n            \n            for (int r = 16; d < len; r -= eight) {\n                dArr[d++] = (byte) (i >> r);\n            }\n        }\n        \n        return dArr;\n    }\n    \n    private static int ctoi(char c) {\n        int i = c > IALPHABET_MAX_INDEX ? -1 : IALPHABET[c];\n        if (i < 0) {\n            String msg = \"Illegal base64 character: '\" + c + \"'\";\n            throw new IllegalArgumentException(msg);\n        }\n        return i;\n    }\n    \n}\n","sourceCodeStart":112,"sourceCodeEnd":136,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-default-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/utils/Base64Decode.java#L112-L136","documentation":"Thrown by Base64Decode.ctoi() when the decode() method encounters a character that is not in the Base64 alphabet (A-Z, a-z, 0-9, +, /, =). The IALPHABET lookup table maps valid characters to their index and all others to -1; when ctoi sees a -1 it throws IllegalArgumentException naming the offending character. This is a custom Base64 decoder used in the Nacos auth plugin for processing tokens, credentials, or identity-related data.","triggerScenarios":"Calling Base64Decode.decode(input) where input contains any character outside [A-Za-z0-9+/=], including whitespace, newlines in unexpected positions, URL-safe base64 characters (- or _), or completely corrupted/garbled data.","commonSituations":"A token or credential string that was URL-encoded but not decoded before base64 processing; URL-safe base64 variant (- and _ instead of + and /) fed to a standard decoder; corrupted or truncated token from a misconfigured client; a JSON string or raw text mistakenly passed where base64 was expected.","solutions":["Inspect the exact character reported in the error message — it reveals what kind of data corruption occurred.","If the input uses URL-safe base64, replace '-' with '+' and '_' with '/' before decoding, or use a decoder that supports the URL-safe variant.","Strip whitespace and newlines from the input before decoding if the data came from a formatted source.","Verify the upstream process that generated the base64 string is using standard base64 encoding (not hex, not URL-encoded, not raw text)."],"exampleFix":"// before: throws on URL-safe base64 or dirty input\nbyte[] decoded = Base64Decode.decode(token);\n\n// after: sanitize and normalize input first\nString sanitized = token.trim()\n    .replace('-', '+')\n    .replace('_', '/')\n    .replaceAll(\"\\\\s\", \"\");\nbyte[] decoded = Base64Decode.decode(sanitized);","handlingStrategy":"validation","validationCode":"// Validate input is valid standard base64 before decoding\nprivate static boolean isValidBase64(String input) {\n    if (input == null || input.isEmpty()) return true;\n    return input.matches(\"^[A-Za-z0-9+/]+={0,2}$\");\n}\n\nif (!isValidBase64(input)) {\n    // try URL-safe variant normalization\n    input = input.replace('-', '+').replace('_', '/');\n    if (!isValidBase64(input)) {\n        throw new IllegalArgumentException(\"Input is not valid base64\");\n    }\n}","typeGuard":"// Check if string is decodable base64 without throwing\npublic static boolean isBase64Decodable(String input) {\n    if (input == null || input.isEmpty()) return true;\n    for (char c : input.toCharArray()) {\n        if (!(c >= 'A' && c <= 'Z') && !(c >= 'a' && c <= 'z')\n            && !(c >= '0' && c <= '9') && c != '+' && c != '/' && c != '=') {\n            return false;\n        }\n    }\n    return true;\n}","tryCatchPattern":"try {\n    byte[] decoded = Base64Decode.decode(input);\n} catch (IllegalArgumentException e) {\n    // e.getMessage() contains the offending character\n    log.warn(\"Base64 decode failed: {}\", e.getMessage());\n    throw e;\n}","preventionTips":["Validate base64 input format before decoding.","Normalize URL-safe base64 (- and _) to standard (+ and /) before passing to this decoder.","Strip whitespace and newlines from base64 strings sourced from formatted text.","Use java.util.Base64.getDecoder() for standard decoding or getMimeDecoder() for lenient MIME-style input."],"tags":["auth","base64","encoding","validation","token"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}