{"record":{"id":"d8e1acb59f0625a7","repo":"pinpoint-apm/pinpoint","slug":"invalid-src-byte-array-src","errorCode":null,"errorMessage":"Invalid src byte array: ${src}","messagePattern":"Invalid src byte array: (.+?)","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"commons-profiler/src/main/java/com/navercorp/pinpoint/common/profiler/name/Base64Utils.java","lineNumber":103,"sourceCode":"        return new String(encode, ISO_8859);\n    }\n\n    /**\n     * Decodes the given {@code src} string into a {@link UUID}. {@code src} must be a URL and filename safe base64\n     * encoded string 22 characters in length without pad characters \"=\".\n     *\n     * @param src string to be decoded into {@link UUID}\n     * @return uuid decoded from the given {@code src}\n     *\n     * @throws NullPointerException if {@code src} is null\n     * @throws IllegalArgumentException if {@code src} is not a URL and filename safe base64 encoded string without\n     *                                  trailing pad characters\n     */\n    public static UUID decode(String src) {\n        Objects.requireNonNull(src, \"src\");\n        byte[] bytes = src.getBytes(ISO_8859);\n        if (bytes.length != 22) {\n            throw new IllegalArgumentException(\"Invalid src byte array: \" + src);\n        }\n\n        byte[] decoded = DECODER.decode(bytes);\n\n        long mostSigBits = BytesUtils.bytesToLong(decoded, 0);\n        long leastSigBits = BytesUtils.bytesToLong(decoded, BytesUtils.LONG_BYTE_LENGTH);\n        return new UUID(mostSigBits, leastSigBits);\n    }\n\n}\n","sourceCodeStart":85,"sourceCodeEnd":114,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/commons-profiler/src/main/java/com/navercorp/pinpoint/common/profiler/name/Base64Utils.java#L85-L114","documentation":"Base64Utils.decode(String) converts a 22-character URL-safe Base64 string back into a UUID. The library throws IllegalArgumentException immediately when the input is not exactly 22 ISO-8859-1 bytes, because that is the only length that decodes to the 16 bytes (two longs) a UUID requires. It is a fail-fast guard against malformed UUID strings before any decoding happens.","triggerScenarios":"Calling Base64Utils.decode() with a string whose length is not 22 — e.g. a full 36-char UUID string with dashes, a Base64 string that still contains padding '=' characters, a truncated/corrupted ID, or passing a non-UUID value such as an agent ID or transaction ID.","commonSituations":"Developers pass a standard java.util.UUID.toString() output (with '-' separators, wrong length) instead of the Base64-formatted string produced by Base64Utils.encode(UUID); deserializing IDs from logs or HTTP parameters where the value was truncated or URL-encoded differently; mixing versions where one side emits padded Base64.","solutions":["Verify the input is exactly 22 characters before calling decode","Convert a standard UUID first: Base64Utils.encode(UUID.fromString(uuidString)) instead of passing the raw uuidString","Strip Base64 padding characters ('=') and any URL-encoding before decoding","Check where the string was produced; regenerate it with Base64Utils.encode on the writer side"],"exampleFix":"// before\nUUID id = Base64Utils.decode(request.getParameter(\"id\")); // crashes on 36-char UUID\n// after\nString raw = request.getParameter(\"id\");\nif (raw == null || raw.length() != 22) {\n    throw new IllegalArgumentException(\"expected 22-char base64 uuid, got: \" + raw);\n}\nUUID id = Base64Utils.decode(raw);","handlingStrategy":"validation","validationCode":"if (src == null || src.length() != 22) {\n    throw new IllegalArgumentException(\"expected 22-char base64 uuid, got: \" + src);\n}\nUUID id = Base64Utils.decode(src);","typeGuard":"boolean isEncodedUuid(String s) {\n    return s != null && s.length() == 22;\n}","tryCatchPattern":"try {\n    UUID id = Base64Utils.decode(src);\n} catch (IllegalArgumentException e) {\n    // fall back: treat src as a plain UUID string\n    UUID id = UUID.fromString(src);\n}","preventionTips":["Always validate the 22-char length before decoding","Never pass UUID.toString() output directly to decode; encode/decode symmetrically with Base64Utils","Keep IDs as UUID objects end-to-end and only encode at the serialization boundary","Beware URL-encoding and padding characters when IDs travel via HTTP"],"tags":["uuid","base64","argument-validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}