Python: reject malformed checkpoint Base64 payloads

[fzfzzfzzzfzzzz]

Motivation & Context

base64.b64decode() is permissive by default and silently discards non-Base64 characters. As a result, a malformed checkpoint pickle payload can be accepted and decoded instead of producing the documented WorkflowCheckpointException.

Description & Review Guide

• What are the major changes? Enable strict Base64 validation for pickled checkpoint payloads and add a regression test using an otherwise-valid payload with illegal trailing characters.
• What is the impact of these changes? Malformed pickle envelopes now fail through the existing checkpoint exception path; payloads emitted by encode_checkpoint_value() are unchanged.
• What do you want reviewers to focus on? Whether strict validation is the desired compatibility boundary for externally supplied checkpoint envelopes.

Related Issue

Fixes #8257

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The change is narrowly scoped, aligns behavior with documented expectations, and includes a targeted regression test covering the new strict validation behavior.

Pull request overview

This PR tightens Python checkpoint decoding to reject malformed Base64 pickle payloads by enabling strict Base64 validation, aligning runtime behavior with the documented WorkflowCheckpointException error path.

Changes:

• Switch checkpoint pickle payload decoding to base64.b64decode(..., validate=True) to reject non-Base64 characters.
• Add a regression test that appends illegal trailing characters to an otherwise valid pickled checkpoint payload and asserts WorkflowCheckpointException.

File summaries

File	Description
python/packages/core/agent_framework/_workflows/_checkpoint_encoding.py	Enables strict Base64 validation when decoding pickled checkpoint payloads so malformed envelopes fail deterministically.
python/packages/core/tests/workflow/test_checkpoint_decode.py	Adds a regression test ensuring malformed Base64 pickle payloads raise WorkflowCheckpointException.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[fzfzzfzzzfzzzz]

@microsoft-github-policy-service agree

[Eduard van Valkenburg (eavanvalkenburg)]

Thanks for the update. Before this is ready, could you please:

• get the non-green checks passing: merge-gatekeeper (FAILURE), command_check (CANCELLED), team_check (CANCELLED), review (CANCELLED)

Once those are addressed, please re-request review. Thanks!

[fzfzzfzzzfzzzz]

Thanks — I checked #8262 as well. command_check passed, but the DevFlow PR Review run was cancelled before team_check completed because a higher-priority request in the same concurrency group was waiting.

I don't have permission to rerun the upstream workflow. Could you please retrigger the DevFlow PR Review for #8262? Once team_check completes successfully, the Merge Gatekeeper can be rerun.