Fixed invalid base64 ID parsing (#8101)

Author: faddiv

src/HotChocolate/Core/src/Types/Types/Relay/Serialization/DefaultNodeIdSerializer.cs

@@ -204,7 +204,12 @@ public NodeId Parse(string formattedId, INodeIdRuntimeTypeLookup runtimeTypeLook
             }
         }
 
-        Base64.DecodeFromUtf8InPlace(span, out var written);
+        var operationStatus = Base64.DecodeFromUtf8InPlace(span, out var written);
+        if (operationStatus != OperationStatus.Done)
+        {
+            throw new NodeIdInvalidFormatException(formattedId);
+        }
+
         span = span.Slice(0, written);
 
         var delimiterIndex = FindDelimiterIndex(span);
@@ -275,7 +280,12 @@ public NodeId Parse(string formattedId, Type runtimeType)
             }
         }
 
-        Base64.DecodeFromUtf8InPlace(span, out var written);
+        var operationStatus = Base64.DecodeFromUtf8InPlace(span, out var written);
+        if (operationStatus != OperationStatus.Done)
+        {
+            throw new NodeIdInvalidFormatException(formattedId);
+        }
+
         span = span.Slice(0, written);
 
         var delimiterIndex = FindDelimiterIndex(span);

src/HotChocolate/Core/src/Types/Types/Relay/Serialization/OptimizedNodeIdSerializer.cs

@@ -106,7 +106,12 @@ public unsafe NodeId Parse(string formattedId, INodeIdRuntimeTypeLookup runtimeT
             }
         }
 
-        Base64.DecodeFromUtf8InPlace(span, out var written);
+        var operationStatus = Base64.DecodeFromUtf8InPlace(span, out var written);
+        if (operationStatus != OperationStatus.Done)
+        {
+            throw new NodeIdInvalidFormatException(formattedId);
+        }
+
         span = span.Slice(0, written);
 
         var delimiterIndex = FindDelimiterIndex(span);
@@ -176,7 +181,12 @@ public unsafe NodeId Parse(string formattedId, Type runtimeType)
             }
         }
 
-        Base64.DecodeFromUtf8InPlace(span, out var written);
+        var operationStatus = Base64.DecodeFromUtf8InPlace(span, out var written);
+        if (operationStatus != OperationStatus.Done)
+        {
+            throw new NodeIdInvalidFormatException(formattedId);
+        }
+
         span = span.Slice(0, written);
 
         var delimiterIndex = FindDelimiterIndex(span);

src/HotChocolate/Core/test/Types.Tests/Types/Relay/DefaultNodeIdSerializerTests.cs

@@ -518,6 +518,26 @@ public void Parse_Legacy_StronglyTypedId()
         Assert.Equal(stronglyTypedId, parsed.InternalId);
     }
 
+    [Fact]
+    public void Parse_Throws_NodeIdInvalidFormatException_On_InvalidBase64Input()
+    {
+        var serializer = CreateSerializer(new StringNodeIdValueSerializer());
+
+        Assert.Throws<NodeIdInvalidFormatException>(
+            () => serializer.Parse("Rm9vOkJhcg", typeof(string)));
+    }
+
+    [Fact]
+    public void ParseOnRuntimeLookup_Throws_NodeIdInvalidFormatException_On_InvalidBase64Input()
+    {
+        var lookup = new Mock<INodeIdRuntimeTypeLookup>();
+        lookup.Setup(t => t.GetNodeIdRuntimeType(default)).Returns(default(Type));
+        var serializer = CreateSerializer(new StringNodeIdValueSerializer());
+
+        Assert.Throws<NodeIdInvalidFormatException>(
+            () => serializer.Parse("Rm9vOkJhcg", lookup.Object));
+    }
+
     [Fact]
     public void Ensure_Lookup_Works_With_HashCollision()
     {

src/HotChocolate/Core/test/Types.Tests/Types/Relay/OptimizedNodeIdSerializerTests.cs

@@ -440,6 +440,27 @@ public void Parse_CompositeId()
         Assert.Equal(compositeId, parsed.InternalId);
     }
 
+    [Fact]
+    public void Parse_Throws_NodeIdInvalidFormatException_On_InvalidBase64Input()
+    {
+        var serializer = CreateSerializer("Foo", new StringNodeIdValueSerializer());
+
+        Assert.Throws<NodeIdInvalidFormatException>(
+            () => serializer.Parse("Rm9vOkJhcg", typeof(string)));
+    }
+
+    [Fact]
+    public void ParseOnRuntimeLookup_Throws_NodeIdInvalidFormatException_On_InvalidBase64Input()
+    {
+        var lookup = new Mock<INodeIdRuntimeTypeLookup>();
+        lookup.Setup(t => t.GetNodeIdRuntimeType(default)).Returns(default(Type));
+
+        var serializer = CreateSerializer("Foo", new StringNodeIdValueSerializer());
+
+        Assert.Throws<NodeIdInvalidFormatException>(
+            () => serializer.Parse("Rm9vOkJhcg", lookup.Object));
+    }
+
     [Fact]
     public void Ensure_Lookup_Works_With_HashCollision()
     {