From d5c2aaeea351ed3908b43186c331aada6c158aa9 Mon Sep 17 00:00:00 2001
From: Pierre Tachoire <pierre@lightpanda.io>
Date: Mon, 9 Feb 2026 17:08:32 +0100
Subject: [PATCH] window.atob must trim input

---
 src/browser/tests/window/window.html | 8 ++++++++
 src/browser/webapi/Window.zig        | 5 +++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/browser/tests/window/window.html b/src/browser/tests/window/window.html
index 290f9874..46d32940 100644
--- a/src/browser/tests/window/window.html
+++ b/src/browser/tests/window/window.html
@@ -52,6 +52,7 @@
 <script id=btoa>
   testing.expectEqual('SGVsbG8gV29ybGQh', btoa('Hello World!'));
   testing.expectEqual('', btoa(''));
+  testing.expectEqual('IA==', btoa(' '));
   testing.expectEqual('YQ==', btoa('a'));
   testing.expectEqual('YWI=', btoa('ab'));
   testing.expectEqual('YWJj', btoa('abc'));
@@ -62,6 +63,13 @@
 <script id=atob>
   testing.expectEqual('Hello World!', atob('SGVsbG8gV29ybGQh'));
   testing.expectEqual('', atob(''));
+
+  // atob must trim input
+  testing.expectEqual('', atob(' '));
+  testing.expectEqual(' ', atob('IA=='));
+  testing.expectEqual(' ', atob(' IA=='));
+  testing.expectEqual(' ', atob('IA== '));
+
   testing.expectEqual('a', atob('YQ=='));
   testing.expectEqual('ab', atob('YWI='));
   testing.expectEqual('abc', atob('YWJj'));
diff --git a/src/browser/webapi/Window.zig b/src/browser/webapi/Window.zig
index 6e05be6a..a1939b8a 100644
--- a/src/browser/webapi/Window.zig
+++ b/src/browser/webapi/Window.zig
@@ -373,9 +373,10 @@ pub fn btoa(_: *const Window, input: []const u8, page: *Page) ![]const u8 {
 }
 
 pub fn atob(_: *const Window, input: []const u8, page: *Page) ![]const u8 {
-    const decoded_len = std.base64.standard.Decoder.calcSizeForSlice(input) catch return error.InvalidCharacterError;
+    const trimmed = std.mem.trim(u8, input, &std.ascii.whitespace);
+    const decoded_len = std.base64.standard.Decoder.calcSizeForSlice(trimmed) catch return error.InvalidCharacterError;
     const decoded = try page.call_arena.alloc(u8, decoded_len);
-    std.base64.standard.Decoder.decode(decoded, input) catch return error.InvalidCharacterError;
+    std.base64.standard.Decoder.decode(decoded, trimmed) catch return error.InvalidCharacterError;
     return decoded;
 }