spring-projects/spring-security · error · Saml2Exception

Unable to inflate string

Error message

Unable to inflate string

What it means

Saml2Utils.samlInflate decompresses a DEFLATE-encoded SAML message received via HTTP-Redirect binding. This Saml2Exception is thrown when decompression fails (IOException), typically because the bytes are not raw-DEFLATE data or exceed the CappedOutputStream size limit wrapped inside the stream.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java:74

			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);
	}

	static DecodingConfigurer withEncoded(String encoded) {
		return new DecodingConfigurer(encoded);
	}

	static final class EncodingConfigurer {

		private final String decoded;

		private boolean deflate;

		private EncodingConfigurer(String decoded) {

View on GitHub (pinned to 96852e8860)

Solutions

  1. Verify the message is Base64-decoded correctly before calling samlInflate
  2. Confirm the IdP uses raw DEFLATE (no zlib header) for redirect binding; fix IdP config if not
  3. Log the wrapped cause to distinguish corruption vs size-cap and re-request the assertion via POST binding instead
  4. Check payload size against MAX_SIZE — oversized responses must be delivered via POST binding

Example fix

// before
 byte[] raw = Base64.getUrlDecoder().decode(samlParam);
 String xml = Saml2Utils.samlInflate(raw); // fails: double-decoded or zlib data
// after
 byte[] raw = Base64.getDecoder().decode(samlParam); // decode exactly once
 String xml = Saml2Utils.samlInflate(raw);
Defensive patterns

Strategy: try-catch

Validate before calling

// decode once, verify Base64 before inflating
byte[] raw;
try { raw = Base64.getDecoder().decode(b64); }
catch (IllegalArgumentException e) { return null; }
if (raw.length > MAX_EXPECTED_COMPRESSED) return null;

Try / catch

try {
    String xml = Saml2Utils.samlInflate(raw);
} catch (Saml2Exception e) {
    // likely corrupt/non-raw-deflate input or size cap; log and reject request
}

Prevention

When it happens

Trigger: samlInflate(byte[] b) writes to an InflaterOutputStream over a CappedOutputStream; corrupt/truncated/zlib-headed (not raw) deflate data, or payload exceeding MAX_SIZE, causes IOException and the "Unable to inflate string" Saml2Exception.

Common situations: IdP sends zlib-wrapped or gzip compression instead of raw DEFLATE; SAML message tampered or truncated in transit; redirect URL decoding (Base64) performed incorrectly before inflation; hostile oversized payload hitting the size cap.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/49d53c4bfc7e4846. Report an issue: GitHub.