{"record":{"id":"ede0f593b508d994","repo":"spring-projects/spring-security","slug":"unable-to-inflate-string-ede0f5","errorCode":null,"errorMessage":"Unable to inflate string","messagePattern":"Unable to inflate string","errorType":"exception","errorClass":"Saml2Exception","httpStatus":500,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java","lineNumber":74,"sourceCode":"\t\t\tdeflater.write(s.getBytes(StandardCharsets.UTF_8));\n\t\t\tdeflater.finish();\n\t\t\treturn b.toByteArray();\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to deflate string\", ex);\n\t\t}\n\t}\n\n\tstatic String samlInflate(byte[] b) {\n\t\ttry {\n\t\t\tByteArrayOutputStream out = new ByteArrayOutputStream();\n\t\t\tInflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));\n\t\t\tiout.write(b);\n\t\t\tiout.finish();\n\t\t\treturn new String(out.toByteArray(), StandardCharsets.UTF_8);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to inflate string\", ex);\n\t\t}\n\t}\n\n\tstatic EncodingConfigurer withDecoded(String decoded) {\n\t\treturn new EncodingConfigurer(decoded);\n\t}\n\n\tstatic DecodingConfigurer withEncoded(String encoded) {\n\t\treturn new DecodingConfigurer(encoded);\n\t}\n\n\tstatic final class EncodingConfigurer {\n\n\t\tprivate final String decoded;\n\n\t\tprivate boolean deflate;\n\n\t\tprivate EncodingConfigurer(String decoded) {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java#L56-L92","documentation":"Thrown by Saml2Utils.samlInflate when DEFLATE-inflating a decoded SAML message (Redirect binding) fails with an IOException. The base64-decoded value was not valid zlib/DEFLATE data. Wrapped as Saml2Exception with the original IOException as cause.","triggerScenarios":"Processing a SAML message received via HTTP-Redirect binding whose base64-decoded bytes are not DEFLATE-compressed — e.g. the sender sent raw XML or plain base64 without compression, or the value was corrupted in transit.","commonSituations":"IDP configured for Redirect binding but sending uncompressed payload; double base64-encoding; URL-decoding issues mangling '+' and '=' in the query string before decode; proxies rewriting the SAMLRequest/SAMLResponse parameter.","solutions":["Confirm the IDP applies DEFLATE (raw, no zlib header) before base64-encoding when using Redirect binding","Verify SigAlg/URL decoding: ensure the parameter is URL-decoded before base64-decode (missing '+' handling corrupts bytes)","Compare a captured request from the IDP: decode manually and check it inflates","Check for intermediaries altering the query parameter encoding"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { /* redirect-binding saml processing */ } catch (Saml2Exception ex) {\n    log.warn(\"SAML message could not be inflated; check IDP binding config\", ex);\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n}","preventionTips":["Confirm the IDP DEFLATEs before base64 for Redirect binding","Ensure URL-decoding happens before base64 decoding ('+' must survive transport)","Test the full SSO round trip against the real IDP metadata"],"tags":["saml2","spring-security","deflate","redirect-binding"],"backgroundTag":"invalid-argument-format","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}