fix: Replace java.util.Base64 with android.util.Base64 for backwards compatibility#20
fix: Replace java.util.Base64 with android.util.Base64 for backwards compatibility#20RickyJam wants to merge 2 commits intosbaiahmed1:mainfrom
Conversation
📝 WalkthroughWalkthroughThe Google Auth module's Base64 decoding strategy was updated from Java's standard Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@android/src/main/java/com/googleauth/GoogleAuthModule.kt`:
- Line 883: The Base64 decoding here uses Base64.NO_WRAP which fails for
base64url JWT payloads; update the decode call in GoogleAuthModule.kt (the line
building payload from parts[1]) to use Base64.URL_SAFE instead of
Base64.NO_WRAP, matching the fix used in parseTokenExpiration so JWTs encoded
with URL-safe base64 decode correctly.
- Line 867: The JWT payload decoding in GoogleAuthModule (the line creating the
payload variable from parts[1]) uses android.util.Base64.decode with
Base64.NO_WRAP which is incorrect for base64url JWTs; update the Base64.decode
call to use Base64.URL_SAFE (e.g., replace Base64.NO_WRAP with Base64.URL_SAFE)
or switch to java.util.Base64.getUrlDecoder().decode(parts[1]) so the URL-safe
alphabet is handled correctly and padding/unwrap issues are avoided.
| val parts = idToken.split(".") | ||
| if (parts.size >= 2) { | ||
| val payload = String(Base64.getUrlDecoder().decode(parts[1])) | ||
| val payload = String(Base64.decode(parts[1], Base64.NO_WRAP)) |
There was a problem hiding this comment.
Bug: Base64.NO_WRAP does not handle URL-safe Base64 — JWT payloads use base64url encoding.
JWTs encode their payload using base64url (RFC 7515), which substitutes + → - and / → _. The previous code correctly used java.util.Base64.getUrlDecoder(). Replacing it with android.util.Base64.decode(..., Base64.NO_WRAP) uses the standard alphabet and will silently produce corrupted output (or throw) whenever the payload contains - or _ characters.
Use Base64.URL_SAFE (which also implies no wrap/padding handling) instead:
Proposed fix
- val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))
+ val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| val payload = String(Base64.decode(parts[1], Base64.NO_WRAP)) | |
| val payload = String(Base64.decode(parts[1], Base64.URL_SAFE)) |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@android/src/main/java/com/googleauth/GoogleAuthModule.kt` at line 867, The
JWT payload decoding in GoogleAuthModule (the line creating the payload variable
from parts[1]) uses android.util.Base64.decode with Base64.NO_WRAP which is
incorrect for base64url JWTs; update the Base64.decode call to use
Base64.URL_SAFE (e.g., replace Base64.NO_WRAP with Base64.URL_SAFE) or switch to
java.util.Base64.getUrlDecoder().decode(parts[1]) so the URL-safe alphabet is
handled correctly and padding/unwrap issues are avoided.
| val parts = idToken.split(".") | ||
| if (parts.size >= 2) { | ||
| val payload = String(Base64.getUrlDecoder().decode(parts[1])) | ||
| val payload = String(Base64.decode(parts[1], Base64.NO_WRAP)) |
There was a problem hiding this comment.
Same base64url bug as parseTokenExpiration — use Base64.URL_SAFE here too.
Proposed fix
- val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))
+ val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))(Ensure this line reads Base64.URL_SAFE instead of Base64.NO_WRAP.)
- val payload = String(Base64.decode(parts[1], Base64.NO_WRAP))
+ val payload = String(Base64.decode(parts[1], Base64.URL_SAFE))📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| val payload = String(Base64.decode(parts[1], Base64.NO_WRAP)) | |
| val payload = String(Base64.decode(parts[1], Base64.URL_SAFE)) |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@android/src/main/java/com/googleauth/GoogleAuthModule.kt` at line 883, The
Base64 decoding here uses Base64.NO_WRAP which fails for base64url JWT payloads;
update the decode call in GoogleAuthModule.kt (the line building payload from
parts[1]) to use Base64.URL_SAFE instead of Base64.NO_WRAP, matching the fix
used in parseTokenExpiration so JWTs encoded with URL-safe base64 decode
correctly.
|
Fixing coderabbitai suggestion Base64.URL_SAFE flag |
2 participants
Summary
This PR replaces the usage of
java.util.Base64withandroid.util.Base64to ensure full compatibility across all supported Android API levels.Problem
java.util.Base64is not available to android SDK < 26, but the minSdk is 24. This results injava.lang.NoClassDefFoundError: java.util.Base64that stops google auth process.Proposed Solution
java.util.Base64with the most appropriateandorid.util.Base64in order to grant backwards compatibility to < 26 android versions.Testing
Summary by CodeRabbit