fix: preserve value in t:base64Decode when input is not valid base64

Add Base64::tryDecode() that checks mbedtls return value before
replacing the variable. On invalid input, the original value is
now preserved and transform returns false.

Author: 0xst3m

src/actions/transformations/base64_decode.cc

@@ -23,9 +23,14 @@ namespace modsecurity::actions::transformations {
 
 bool Base64Decode::transform(std::string &value, const Transaction *trans) const {
     if (value.empty()) return false;
-    value = Utils::Base64::decode(value);
+
+    std::string decoded;
+    if (!Utils::Base64::tryDecode(value, decoded)) {
+        return false;
+    }
+
+    value = std::move(decoded);
     return true;
 }
 
-
 }  // namespace modsecurity::actions::transformations

src/utils/base64.cc

@@ -63,6 +63,27 @@ std::string Base64::decode(const std::string& data) {
     return base64Helper(data.c_str(), strlen(data.c_str()), mbedtls_base64_decode);
 }
 
+bool Base64::tryDecode(const std::string& data, std::string &out) {
+    size_t out_len = 0;
+    const auto *src = reinterpret_cast<const unsigned char *>(data.c_str());
+    const size_t slen = strlen(data.c_str());
+
+    const int ret = mbedtls_base64_decode(nullptr, 0, &out_len, src, slen);
+
+    if (ret != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) {
+        return false;
+    }
+
+    out.resize(out_len);
+    if (mbedtls_base64_decode(
+            reinterpret_cast<unsigned char *>(out.data()),
+            out.size(), &out_len, src, slen) != 0) {
+        return false;
+    }
+
+    out.resize(out_len);
+    return true;
+}
 
 std::string Base64::decode_forgiven(const std::string& data) {
     return base64Helper(data.c_str(), data.size(), decode_forgiven_engine);

src/utils/base64.h

@@ -30,6 +30,7 @@ class Base64 {
 
     static std::string decode(const std::string& data, bool forgiven);
     static std::string decode(const std::string& data);
+    static bool tryDecode(const std::string& data, std::string &out);
     static std::string decode_forgiven(const std::string& data);
 
     static void decode_forgiven_engine(unsigned char *plain_text,