{"record":{"id":"e8123ddc1544f3b9","repo":"spring-projects/spring-security","slug":"unable-to-inflate-string-e8123d","errorCode":null,"errorMessage":"Unable to inflate string","messagePattern":"Unable to inflate string","errorType":"exception","errorClass":"Saml2Exception","httpStatus":500,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java","lineNumber":74,"sourceCode":"\t\t\tdeflater.write(s.getBytes(StandardCharsets.UTF_8));\n\t\t\tdeflater.finish();\n\t\t\treturn b.toByteArray();\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to deflate string\", ex);\n\t\t}\n\t}\n\n\tstatic String samlInflate(byte[] b) {\n\t\ttry {\n\t\t\tByteArrayOutputStream out = new ByteArrayOutputStream();\n\t\t\tInflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));\n\t\t\tiout.write(b);\n\t\t\tiout.finish();\n\t\t\treturn new String(out.toByteArray(), StandardCharsets.UTF_8);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to inflate string\", ex);\n\t\t}\n\t}\n\n\tstatic EncodingConfigurer withDecoded(String decoded) {\n\t\treturn new EncodingConfigurer(decoded);\n\t}\n\n\tstatic DecodingConfigurer withEncoded(String encoded) {\n\t\treturn new DecodingConfigurer(encoded);\n\t}\n\n\tstatic final class EncodingConfigurer {\n\n\t\tprivate final String decoded;\n\n\t\tprivate boolean deflate;\n\n\t\tprivate EncodingConfigurer(String decoded) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java#L56-L92","documentation":"Same decompression logic as Saml2Utils.samlInflate in the service/web package, but this class lives in the authentication package: it raw-DEFLATE inflates SAML redirect-binding payloads, wrapping any IOException (invalid, truncated, or non-compressed input) in Saml2Exception 'Unable to inflate string'.","triggerScenarios":"Processing a redirect-binding SAMLRequest/SAMLResponse (e.g. via Saml2RedirectAuthenticationRequestResolver) whose bytes, after single URL-decode and base64-decode, are not valid raw DEFLATE data.","commonSituations":"IdP sends uncompressed redirect-binding messages while the SP inflates; double URL/base64 decoding somewhere in a proxy chain; manually decoding the parameter before handing it to the resolver so it gets decoded twice; truncated query strings caused by proxies or intermediaries.","solutions":["Let Spring's resolver do the decoding: pass the raw HttpServletRequest parameter through instead of pre-decoding the b64 value.","Detect plain-XML payloads and skip inflation (check for '<' or a saml namespace in the decoded string).","Verify the IdP's redirect-binding compression settings (AuthnRequestsSigned / compress settings) match the SP expectation.","Log payload length and catch Saml2Exception to return HTTP 400 for malformed redirect requests."],"exampleFix":"// before\nString xml = Saml2Utils.samlInflate(Base64.getDecoder().decode(request.getParameter(\"SAMLRequest\")));\n// after\nString decodedStr = new String(Base64.getDecoder().decode(request.getParameter(\"SAMLRequest\")), StandardCharsets.UTF_8);\nString xml = decodedStr.startsWith(\"<\") ? decodedStr : Saml2Utils.samlInflate(request.getParameter(\"SAMLRequest\")).getBytes(); // or use resolver API","handlingStrategy":"try-catch","validationCode":"String decoded = new String(Base64.getDecoder().decode(param), StandardCharsets.UTF_8);\nif (decoded.contains(\"<\")) { /* plain XML, skip inflation */ }","typeGuard":null,"tryCatchPattern":"try {\n    String xml = Saml2Utils.samlInflate(bytes);\n} catch (Saml2Exception ex) {\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n}","preventionTips":["Use Saml2RedirectAuthenticationRequestResolver instead of manual decode+inflate","Ensure single URL-decode and single base64-decode across the request path","Check IdP compression configuration matches SP expectations","Guard against truncated payloads caused by proxy URL-length limits"],"tags":["saml2","spring-security","deflate","authentication"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}