encoding/base64: document that Strict mode still ignores newlines

An application that wants to reject non-canonical encodings is likely to
care about other sources of malleability.

Change-Id: I1d3a5b281d2631ca78df3f89b957a02687a534d8
Reviewed-on: https://go-review.googlesource.com/c/go/+/188858
Reviewed-by: Katie Hockman <katie@golang.org>

diff --git a/src/encoding/base64/base64.go b/src/encoding/base64/base64.go
index 082210198f3800dcfff892075b6acd795302731a..690d3ce0421f8682a94682e1fd1944ab60245491 100644 (file)
--- a/src/encoding/base64/base64.go
+++ b/src/encoding/base64/base64.go
@@ -86,6 +86,9 @@ func (enc Encoding) WithPadding(padding rune) *Encoding {
 // Strict creates a new encoding identical to enc except with
 // strict decoding enabled. In this mode, the decoder requires that
 // trailing padding bits are zero, as described in RFC 4648 section 3.5.
+//
+// Note that the input is still malleable, as new line characters
+// (CR and LF) are still ignored.
 func (enc Encoding) Strict() *Encoding {
        enc.strict = true
        return &enc