{"record":{"id":"7503daa3e9fd12a1","repo":"spring-projects/spring-security","slug":"failed-to-deserialize-payload-7503da","errorCode":null,"errorMessage":"Failed to deserialize payload","messagePattern":"Failed to deserialize payload","errorType":"exception","errorClass":"Saml2Exception","httpStatus":500,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/internal/OpenSaml5Template.java","lineNumber":160,"sourceCode":"\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}\n\t\tcatch (MarshallingException ex) {\n\t\t\tthrow new Saml2Exception(ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(Element element) {\n\t\treturn new OpenSaml5SerializationConfigurer(element);","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/internal/OpenSaml5Template.java#L142-L178","documentation":"OpenSaml5Template.deserialize wraps any non-Saml2Exception failure during XML parsing or unmarshalling (e.g. SAX parse errors, IOException, ClassCastException from a mis-typed build) into Saml2Exception('Failed to deserialize payload') with the original as the cause.","triggerScenarios":"deserialize(String/InputStream) is given malformed XML, truncated payload, wrong encoding, or content that parses but fails during unmarshall — any checked Exception other than Saml2Exception in the try block.","commonSituations":"Payload corrupted in transit (URL-decoding issues, whitespace/truncation from logging or trimming); base64-decoded SAML message re-encoded incorrectly; XML with invalid characters or DTDs; wrong charset; passing HTML error pages saved as XML.","solutions":["Read the cause exception attached to this Saml2Exception — it identifies the exact parse/unmarshall failure (line, column, or type problem).","Log and inspect the raw payload before deserialization; ensure the SAML message was correctly base64-decoded and URL-decoded exactly once.","Verify the sender is producing well-formed XML matching the SAML schema (no truncation, no HTML error content).","If the cause is ClassCastException or missing type info, confirm the element is the type your caller expects before calling deserialize."],"exampleFix":"// before: double-decoding corrupts payload\nString xml = new String(Base64.getDecoder().decode(\n        URLDecoder.decode(samlRequest, StandardCharsets.UTF_8)));\n// after: decode base64 only — container already URL-decoded parameters\nString xml = new String(Base64.getDecoder().decode(samlRequest), StandardCharsets.UTF_8);","handlingStrategy":"try-catch","validationCode":"try {\n    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();\n    dbf.setNamespaceAware(true);\n    dbf.newDocumentBuilder().parse(new InputSource(new StringReader(serialized)));\n} catch (SAXException | IOException e) {\n    throw new IllegalArgumentException(\"Payload is not well-formed XML\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return template.deserialize(serialized);\n} catch (Saml2Exception ex) {\n    log.error(\"Deserialization failed\", ex.getCause());\n    throw new Saml2ErrorStatusException(HttpStatus.BAD_REQUEST, ex.getCause());\n}","preventionTips":["Decode base64 exactly once; containers URL-decode request parameters already.","Always specify UTF-8 when converting SAML bytes to Strings.","Log the payload at debug level to detect truncation or HTML contamination.","Check ex.getCause() first — it names the real parse failure."],"tags":["saml2","opensaml","xml-parsing","deserialization"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}