Skip to content

fix: add null check for base64 data URI split in image upload#28

Open
lawrence3699 wants to merge 1 commit intoOrionStarAI:opensourcefrom
lawrence3699:fix/unsafe-base64-split-null-check
Open

fix: add null check for base64 data URI split in image upload#28
lawrence3699 wants to merge 1 commit intoOrionStarAI:opensourcefrom
lawrence3699:fix/unsafe-base64-split-null-check

Conversation

@lawrence3699
Copy link
Copy Markdown

Summary

payload.fileData.split(',')[1] returns undefined if the input doesn't contain a comma (e.g., raw base64 without data URI prefix). Passing undefined to Buffer.from() throws a TypeError at runtime.

Added a length check on the split result with a fallback to the full string, plus an explicit error for empty data.

Test plan

  • Standard data URI (data:image/png;base64,iVBOR...) still works
  • Raw base64 string without prefix no longer crashes
  • Empty data after comma throws descriptive error

`payload.fileData.split(',')[1]` returns `undefined` if the input
string doesn't contain a comma (e.g., raw base64 without data URI
prefix). Passing `undefined` to `Buffer.from()` throws a TypeError.

Added a length check on the split result and falls back to the full
string when no comma is present. Also added an explicit error for
completely empty data.
Copilot AI review requested due to automatic review settings April 2, 2026 05:05
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the NanoBanana image upload handler in the VS Code extension by preventing a runtime crash when the uploaded image string isn’t in data:*/*;base64,<data> URI form.

Changes:

  • Parse payload.fileData more defensively by handling both data URIs and raw base64 strings.
  • Add an explicit error when the parsed base64 payload is empty (instead of passing undefined into Buffer.from()).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +3051 to +3054
const parts = payload.fileData.split(',');
const base64Data = parts.length >= 2 ? parts[1] : payload.fileData;
if (!base64Data) {
throw new Error('Invalid base64 data URI: missing data after comma');
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fallback (parts.length >= 2 ? parts[1] : payload.fileData) will treat a malformed data URI like data:image/png;base64... (missing comma) as if it were raw base64 and decode/upload garbage bytes (Node’s base64 decoding is permissive). Consider explicitly rejecting inputs that start with data: but don’t contain a comma, and only using the raw-string fallback for non-data: inputs.

Suggested change
const parts = payload.fileData.split(',');
const base64Data = parts.length >= 2 ? parts[1] : payload.fileData;
if (!base64Data) {
throw new Error('Invalid base64 data URI: missing data after comma');
let base64Data: string;
if (payload.fileData.startsWith('data:')) {
// 明确处理 data URI:必须包含逗号,将逗号后部分视为 base64
const commaIndex = payload.fileData.indexOf(',');
if (commaIndex === -1) {
throw new Error('Invalid base64 data URI: missing comma separator');
}
base64Data = payload.fileData.slice(commaIndex + 1);
} else {
// 非 data URI,则整个字符串视为原始 base64
base64Data = payload.fileData;
}
if (!base64Data) {
throw new Error('Invalid base64 data: empty payload');

Copilot uses AI. Check for mistakes.
Comment on lines +3051 to +3054
const parts = payload.fileData.split(',');
const base64Data = parts.length >= 2 ? parts[1] : payload.fileData;
if (!base64Data) {
throw new Error('Invalid base64 data URI: missing data after comma');
Copy link

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The thrown error message is specific to “missing data after comma”, but this branch also triggers when payload.fileData is an empty raw base64 string (no comma). Consider adjusting the message (or branching) so it accurately describes both cases, and optionally trimming whitespace before checking emptiness to avoid treating whitespace-only data as valid.

Suggested change
const parts = payload.fileData.split(',');
const base64Data = parts.length >= 2 ? parts[1] : payload.fileData;
if (!base64Data) {
throw new Error('Invalid base64 data URI: missing data after comma');
const rawData = (payload.fileData ?? '').trim();
if (!rawData) {
throw new Error('Invalid base64 data: empty string');
}
const parts = rawData.split(',');
const hasComma = parts.length >= 2;
const base64Part = hasComma ? parts[1] : rawData;
const base64Data = base64Part.trim();
if (!base64Data) {
const reason = hasComma ? 'missing data after comma' : 'empty base64 content';
throw new Error(`Invalid base64 data URI: ${reason}`);

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants