{"record":{"id":"bd1a9c2b0d956e36","repo":"spring-projects/spring-security","slug":"unable-to-deflate-string-bd1a9c","errorCode":null,"errorMessage":"Unable to deflate string","messagePattern":"Unable to deflate string","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/Saml2Utils.java","lineNumber":61,"sourceCode":"\n\tstatic String samlEncode(byte[] b) {\n\t\treturn Base64.getEncoder().encodeToString(b);\n\t}\n\n\tstatic byte[] samlDecode(String s) {\n\t\treturn Base64.getMimeDecoder().decode(s);\n\t}\n\n\tstatic byte[] samlDeflate(String s) {\n\t\ttry {\n\t\t\tByteArrayOutputStream b = new ByteArrayOutputStream();\n\t\t\tDeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));\n\t\t\tdeflater.write(s.getBytes(StandardCharsets.UTF_8));\n\t\t\tdeflater.finish();\n\t\t\treturn b.toByteArray();\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to deflate string\", ex);\n\t\t}\n\t}\n\n\tstatic String samlInflate(byte[] b) {\n\t\ttry {\n\t\t\tByteArrayOutputStream out = new ByteArrayOutputStream();\n\t\t\tInflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));\n\t\t\tiout.write(b);\n\t\t\tiout.finish();\n\t\t\treturn new String(out.toByteArray(), StandardCharsets.UTF_8);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to inflate string\", ex);\n\t\t}\n\t}\n\n\tstatic EncodingConfigurer withDecoded(String decoded) {\n\t\treturn new EncodingConfigurer(decoded);","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/Saml2Utils.java#L43-L79","documentation":"Saml2Utils.samlDeflate wraps any IOException thrown while RAW-DEFLATE compressing a SAML message string into a Saml2Exception with this message. Deflate is applied before Base64 encoding when producing a SAMLResponse/SAMLRequest for HTTP-Redirect bindings. Because the output is a ByteArrayOutputStream, failure is extremely rare (out-of-memory or a defect in the Deflater); it almost always indicates a JVM/platform-level problem rather than bad input.","triggerScenarios":"Calling EncodingConfigurer.deflate(true).encode() (or Saml2Utils.samlDeflate directly) when the DeflaterOutputStream.write or finish() call raises IOException — practically only under JVM memory exhaustion or a corrupted zlib/Deflater implementation.","commonSituations":"Encoding an outbound SAML authentication request for a Redirect binding on a JVM under severe memory pressure; running on a JVM with a broken/patched java.util.zip provider; OOM conditions during large message compression.","solutions":["Retain the causing exception (ex) and check whether it is an OutOfMemoryError wrapped or resource exhaustion; free memory / increase heap","Retry the encode operation; deflate failures here are transient at worst","Verify the JVM's java.util.zip implementation is intact (don't replace zip providers); test deflate on a simple string","If it persists, file a bug with the full stack trace including the cause"],"exampleFix":"// before\nString encoded = Saml2Utils.withDecoded(xml).deflate(true).encode();\n// after\ntry {\n    String encoded = Saml2Utils.withDecoded(xml).deflate(true).encode();\n} catch (Saml2Exception ex) {\n    logger.warn(\"deflate failed\", ex.getCause()); // inspect cause (usually memory)\n}","handlingStrategy":"try-catch","validationCode":"if (xml == null || xml.isEmpty()) { throw new IllegalArgumentException(\"cannot deflate empty SAML message\"); }","typeGuard":"boolean isDeflatable(String xml) { return xml != null && !xml.isEmpty() && xml.length() < 16 * 1024 * 1024; }","tryCatchPattern":"try { encoded = Saml2Utils.withDecoded(xml).deflate(true).encode(); } catch (Saml2Exception ex) { throw new IllegalStateException(\"SAML deflate failed (check memory/JVM zip provider)\", ex); }","preventionTips":["Validate the XML is non-empty before encoding","Monitor heap usage; deflate failures here are almost always resource exhaustion","Keep the cause chain (getCause) when logging to identify the real problem","Avoid custom java.util.zip provider replacements on the JVM"],"tags":["saml","compression","deflate"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}