FIWARE / VCVerifier / 32025629508

62%

main: 62%

Build Type

Pull #114

github

Committed by vramperez

Commit Message

fix(verifier): accept padded base64 vp_token and stop panicking on malformed VPs

decodeVpString only decoded raw(unpadded) base64url, so a client emitting
padded base64 - java's Base64.getUrlEncoder() or python's b64encode() - made
the decode fail and the raw, still-encoded string was passed on. That string
matches no DCQL shape and reaches ParseWithSdJwt, where strings.Split(token,
".")[1] panics on a string without a '.', turning a malformed request into an
empty HTTP 500 instead of a 400.

Accept all four base64 variants in decodeVpString. Tokens that are not base64
at all(compact JWTs, SD-JWTs, plain json dcql responses) are unaffected, since
'.', '~', '{', '"' and ':' are part of no base64 alphabet.

ParseWithSdJwt now reuses the existing extractJWTPayload helper, which checks
the segment count and no longer discards the decode error. Its three remaining
unchecked type assertions - the holder, the verifiableCredential array and its
entries - are guarded as well, since they panic on the same unauthenticated
endpoint.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #114: fix(verifier): accept padded base64 vp_token and stop panicking on malformed VPs

Coverage Stats

43 of 50 new or added lines in 2 files covered. (86.0%)

3 existing lines in 1 file now uncovered.

4903 of 7991 relevant lines covered (61.36%)

0.7 hits per line