Repository navigation
Python: [Bug]: Checkpoint decoder accepts malformed Base64 pickle payloads #8257
Description
Description
The checkpoint pickle decoder calls base64.b64decode() without strict validation. Python's default decoder discards non-alphabet characters, so a malformed checkpoint envelope can be accepted and decoded successfully even though the public decoder documentation says malformed base64 data raises WorkflowCheckpointException.
Expected behavior: malformed base64 checkpoint payloads should fail deterministically with WorkflowCheckpointException rather than being normalized silently.
I intend to submit a focused fix using strict base64 validation and regression tests for invalid characters while preserving valid payload behavior.
Code Sample
from agent_framework._workflows._checkpoint_encoding import (
decode_checkpoint_value,
encode_checkpoint_value,
)
encoded = encode_checkpoint_value((1, 2, 3))
encoded["__pickled__"] += "!!!!"
print(decode_checkpoint_value(encoded))Actual output:
(1, 2, 3)
Expected: WorkflowCheckpointException indicating malformed base64 data.
Error Messages / Stack Traces
No exception is currently raised.
Package Versions
agent-framework-core: source checkout of main at d7823b2
Python Version
Python 3.11.9
Additional Context
base64.b64decode(encoded.encode("ascii"), validate=True) provides the intended strict validation and is compatible with payloads produced by the existing base64.b64encode(...).decode("ascii") encoder.
AI assistance was used to audit the decoder and prepare the reproduction; the behavior was verified against the referenced source checkout.
Metadata
Metadata
Labels
Type
Projects
- Status
Activity
github-actions commentedon Sep 10, 2026
🤖 Automated triage reproduction notes (agent-authored — trust but verify)
Agent analysis
The bug occurs in
python/packages/core/agent_framework/_workflows/_checkpoint_encoding.py::_base64_to_unpickleat line 406 when a pickle envelope’s Base64 payload contains non-alphabet characters. Minimal repro: encode(1, 2, 3), append!!!!toencoded["__pickled__"], and assert thatdecode_checkpoint_value(encoded)raisesWorkflowCheckpointException; it currently returns the tuple.python/packages/core/tests/workflow/test_checkpoint_decode.py::test_decode_raises_on_malformed_base64_pickle_payloadsource checkout of main at d7823b21.18.0