Skip to content

fix: [DataURLObject] keep commas in the data of non-base64 data URLs - #1501

Merged
Rafiot merged 2 commits into
MISP:mainfrom
memx13:fix/dataurl-comma-in-data
Oct 22, 2026
Merged

Rafiot merged 2 commits into
MISP:mainfrom
memx13:fix/dataurl-comma-in-data

Conversation

@memx13

@memx13 memx13 commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

DataURLObject splits a non-base64 data URL on every comma, so any data URL whose payload contains a comma is rejected:

>>> DataURLObject('data:text/plain,hello,world')
MISPObjectException: Invalid Data URL: text/plain,hello,world - too many values to unpack (expected 2, got 3)

Per RFC 2397 only the first comma separates the header from the data, and commas in the data are common (inline SVG path coordinates, CSV, plain text). This change splits on the first comma only; the base64 branch is unchanged.

Adds tests/test_dataurlobject.py, the first tests for this class: the comma case fails before the change and passes after, and a base64 case guards the existing behaviour.

Locally (Python 3.14): pytest tests/test_*.py 128 passed, 2 skipped; mypy reports no issues in the changed files.

@Rafiot

Rafiot commented Oct 22, 2026

Copy link
Copy Markdown
Member

You're right, good catch!

@Rafiot
Rafiot merged commit a4aad77 into MISP:main Oct 22, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants