{"record":{"id":"dc9a0918559faf4e","repo":"spring-projects/spring-security","slug":"failed-to-deserialize-payload-dc9a09","errorCode":null,"errorMessage":"Failed to deserialize payload","messagePattern":"Failed to deserialize payload","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml5Template.java","lineNumber":160,"sourceCode":"\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}\n\t\tcatch (MarshallingException ex) {\n\t\t\tthrow new Saml2Exception(ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(Element element) {\n\t\treturn new OpenSaml5SerializationConfigurer(element);","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml5Template.java#L142-L178","documentation":"OpenSaml5Template.deserialize (authentication package) catches any exception other than Saml2Exception during parsing or unmarshalling — SAX parse errors, IOException, runtime failures — and rethrows as Saml2Exception('Failed to deserialize payload') with the original exception attached as the cause.","triggerScenarios":"deserialize(String/InputStream) given malformed, truncated, wrongly encoded, or unparseable XML, or XML that parses but fails inside unmarshall for any non-Saml2Exception reason.","commonSituations":"SAML message corrupted by incorrect base64/URL decoding; XML containing invalid characters or DTD content rejected by the parser; payloads captured from logs with truncation or HTML error pages; charset mismatches when converting bytes to String.","solutions":["Inspect the cause of the Saml2Exception — it pinpoints the underlying parse failure (line/column or exception type).","Confirm the SAML message is base64-decoded and URL-decoded exactly once, with correct charset (UTF-8).","Log the raw payload before deserialization and validate it is well-formed XML from the expected sender.","Check for intermediary proxies or logging filters that truncate or modify the SAML parameter."],"exampleFix":"// before\nString xml = new String(payload); // platform default charset, possibly wrong\n// after\nString xml = new String(payload, StandardCharsets.UTF_8);","handlingStrategy":"try-catch","validationCode":"try {\n    SAXParserFactory f = SAXParserFactory.newInstance();\n    f.setNamespaceAware(true);\n    f.newSAXParser().parse(new InputSource(new StringReader(serialized)), new DefaultHandler());\n} catch (Exception wellFormedness) {\n    throw new IllegalArgumentException(\"Payload is not well-formed XML\", wellFormedness);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return template.deserialize(serialized);\n} catch (Saml2Exception ex) {\n    log.error(\"Payload deserialization failed; cause=\", ex.getCause());\n    throw new Saml2ErrorStatusException(HttpStatus.BAD_REQUEST, ex.getCause());\n}","preventionTips":["Inspect ex.getCause() — the wrapper hides the real parse error.","Decode the SAML parameter exactly once (base64 only; container URL-decodes).","Force UTF-8 for all byte-to-String conversions of SAML payloads.","Ensure proxies/gateways don't truncate or rewrite the SAML parameter."],"tags":["saml2","opensaml","xml-parsing","deserialization"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}