Skip to content

fix: support non-base64 data URIs per RFC 2397 #1556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lawrence3699 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: support non-base64 data URIs per RFC 2397 #1556

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion baked_in.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -607,7 +607,21 @@ func isDataURI(fl FieldLevel) bool {
return false
}

return base64Regex().MatchString(uri[1])
// After "data:", the prefix must be empty, start with ";", or contain "/"
// to form a valid mediatype. This rejects partial matches like "data:text"
// where the regex only matches the "data:" portion.
if prefix := uri[0][5:]; prefix != "" && !strings.Contains(prefix, "/") && prefix[0] != ';' {
return false
}

// Only validate the data portion as base64 when ;base64 is specified.
// Per RFC 2397, ;base64 is a terminal flag that appears immediately
// before the comma, so it is always a suffix of the prefix portion.
if strings.HasSuffix(uri[0], ";base64") {
return base64Regex().MatchString(uri[1])
}

return true
Comment thread
zemzale marked this conversation as resolved.
Comment on lines +617 to +624

Copilot AI Apr 12, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function now conditionally validates base64 only when ;base64 is present, but the public docs currently state that datauri "will also validate that the data portion is valid base64" unconditionally (see doc.go around the datauri tag documentation). Please update the docs (and any related comment/docstrings) to reflect the new behavior so consumers aren’t misled.

Copilot uses AI. Check for mistakes.

@zemzale zemzale Apr 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Docs should be updated indeed.

}

// hasMultiByteCharacter is the validation function for validating if the field's value has a multi byte character.
Expand Down
5 changes: 4 additions & 1 deletion validator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3997,8 +3997,11 @@ func TestDataURIValidation(t *testing.T) {
{"data:text,:;base85,U3VzcGVuZGlzc2UgbGVjdHVzIGxlbw==", false},
{"data:image/jpeg;key=value;base64,UEsDBBQAAAAI", true},
{"data:image/jpeg;key=value,UEsDBBQAAAAI", true},
{"data:;base64;sdfgsdfgsdfasdfa=s,UEsDBBQAAAAI", true},
{"data:;base64,UEsDBBQAAAAI", true},
{"data:,UEsDBBQAAAAI", true},
{"data:,ohai", true},
{"data:text/plain,hello world", true},
{"data:text/html,<h1>Hello</h1>", true},
Comment on lines +4003 to +4004

Copilot AI Apr 12, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new “valid” non-base64 data URI examples include unescaped spaces and angle brackets (data:text/plain,hello world, data:text/html,<h1>Hello</h1>). Those characters are not valid in a URI unless percent-encoded, and the PR description says the non-base64 form is URL-encoded text. Consider updating these cases to percent-encoded equivalents (e.g. hello%20world, %3Ch1%3EHello%3C%2Fh1%3E) or clarifying (and testing) that the validator intentionally accepts non-URI characters in the data portion.

Suggested change
{"data:text/plain,hello world", true},
{"data:text/html,<h1>Hello</h1>", true},
{"data:text/plain,hello%20world", true},
{"data:text/html,%3Ch1%3EHello%3C%2Fh1%3E", true},

Copilot uses AI. Check for mistakes.

@zemzale zemzale Apr 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would change this, to disallow the non-URL encoded values, and allow URL encoded.

}

validate := New()
Expand Down
Loading