Decode non-base64 image data URI bytes safely

Author: PrzemyslawKlys

OfficeIMO.Html/Images/HtmlImageDataUri.cs

@@ -1,3 +1,4 @@
+using System.IO;
 using System.Text;
 
 namespace OfficeIMO.Html;
@@ -74,7 +75,7 @@ public static bool TryParse(string? source, out HtmlImageDataUri dataUri) {
     /// </summary>
     public byte[] DecodeBytes() {
         if (!IsBase64) {
-            return Encoding.UTF8.GetBytes(Uri.UnescapeDataString(Data));
+            return DecodePercentEncodedBytes(Data);
         }
 
         string payload = NormalizeBase64Payload(Uri.UnescapeDataString(Data));
@@ -110,7 +111,7 @@ public string DecodeText() {
     /// </summary>
     public long EstimateDecodedByteCount() {
         if (!IsBase64) {
-            return Encoding.UTF8.GetByteCount(Uri.UnescapeDataString(Data));
+            return CountPercentDecodedBytes(Data);
         }
 
         string payload = NormalizeBase64Payload(Uri.UnescapeDataString(Data));
@@ -127,6 +128,91 @@ public long EstimateDecodedByteCount() {
         return (long)Math.Ceiling(length / 4D) * 3L - padding;
     }
 
+    private static byte[] DecodePercentEncodedBytes(string data) {
+        using var stream = new MemoryStream();
+        StringBuilder? text = null;
+        for (int i = 0; i < data.Length; i++) {
+            char ch = data[i];
+            if (ch == '%') {
+                FlushTextBytes(text, stream);
+                text?.Clear();
+                stream.WriteByte(ReadEscapedByte(data, i));
+                i += 2;
+                continue;
+            }
+
+            text ??= new StringBuilder();
+            text.Append(ch);
+        }
+
+        FlushTextBytes(text, stream);
+        return stream.ToArray();
+    }
+
+    private static long CountPercentDecodedBytes(string data) {
+        long count = 0;
+        int textStart = 0;
+        for (int i = 0; i < data.Length; i++) {
+            if (data[i] != '%') {
+                continue;
+            }
+
+            if (i > textStart) {
+                count += Encoding.UTF8.GetByteCount(data.Substring(textStart, i - textStart));
+            }
+
+            _ = ReadEscapedByte(data, i);
+            count++;
+            i += 2;
+            textStart = i + 1;
+        }
+
+        if (textStart < data.Length) {
+            count += Encoding.UTF8.GetByteCount(data.Substring(textStart));
+        }
+
+        return count;
+    }
+
+    private static void FlushTextBytes(StringBuilder? text, MemoryStream stream) {
+        if (text == null || text.Length == 0) {
+            return;
+        }
+
+        byte[] bytes = Encoding.UTF8.GetBytes(text.ToString());
+        stream.Write(bytes, 0, bytes.Length);
+    }
+
+    private static byte ReadEscapedByte(string data, int percentIndex) {
+        if (percentIndex + 2 >= data.Length
+            || !TryReadHex(data[percentIndex + 1], out byte high)
+            || !TryReadHex(data[percentIndex + 2], out byte low)) {
+            throw new UriFormatException("Invalid percent escape in data URI payload.");
+        }
+
+        return (byte)((high << 4) | low);
+    }
+
+    private static bool TryReadHex(char value, out byte nibble) {
+        if (value >= '0' && value <= '9') {
+            nibble = (byte)(value - '0');
+            return true;
+        }
+
+        if (value >= 'A' && value <= 'F') {
+            nibble = (byte)(value - 'A' + 10);
+            return true;
+        }
+
+        if (value >= 'a' && value <= 'f') {
+            nibble = (byte)(value - 'a' + 10);
+            return true;
+        }
+
+        nibble = 0;
+        return false;
+    }
+
     private static string GetDataUriContentType(string metadata) {
         if (string.IsNullOrWhiteSpace(metadata)) {
             return string.Empty;

OfficeIMO.Tests/Html.Core.cs

@@ -235,6 +235,15 @@ public void HtmlImageDataUri_TryDecodeBytesReturnsFalseForBadEscapes() {
         Assert.Empty(bytes);
     }
 
+    [Fact]
+    public void HtmlImageDataUri_DecodesNonBase64PercentEscapesAsBytes() {
+        Assert.True(HtmlImageDataUri.TryParse("data:image/png,%89PNG%0D%0A%1A%0A", out var image));
+
+        Assert.False(image.IsBase64);
+        Assert.Equal(new byte[] { 0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A }, image.DecodeBytes());
+        Assert.Equal(8, image.EstimateDecodedByteCount());
+    }
+
     [Fact]
     public void HtmlImageDataUri_MatchesOnlyExactBase64Flag() {
         string svg = "<svg xmlns=\"http://www.w3.org/2000/svg\"/>";