[salimkt]

What

classify_input() tested is_base64() before checking for a file path. On POSIX, / is in the Base64 alphabet, so an existing absolute path made only of alphanumerics and / (e.g. /etc/passwd, /usr/bin/env) was treated as Base64:

• length not a multiple of 4 → rejected with Invalid Base64 input: Incorrect padding
• length a multiple of 4 (e.g. /usr/bin/env) → silently decoded into garbage and then rejected (with the current puremagic this surfaced as an uncaught PureError: Could not identify file)

Changes

• input_contract.classify_input(): return ABSOLUTE_PATH for an absolute path (after ~ expansion) that exists, before the Base64 check. Paths are only preferred when they exist, so Base64 payloads that start with / (every JPEG starts with /9j/) are still classified as Base64.
• utils.is_base64(): also require len(value) % 4 == 0 and a successful base64.b64decode(..., validate=True). This is consistent with decode_base64_payload(), which already used strict decoding, so no previously decodable input is rejected.
• utils.infer_file_type_from_bytes(): return None when puremagic cannot identify the bytes, so callers produce the intended "Unsupported Base64 content type" error instead of a PureError.
• That error now adds If '<value>' is a file path, the file does not exist. when the input starts with /, covering a missing alphabet-only path that is still valid Base64.

Tests

tests/unit/test_mcp_input_contract.py covers is_base64() edge cases, existing alphabet-only paths (/etc/passwd, /usr/bin/env, /bin/sh, skipped if absent), raw PNG Base64, Base64 starting with /9j/, and the missing-path error. 6 of these fail on main and all pass with the fix.

The module skips itself when fastmcp/puremagic are not installed. tests.yml does not install the MCP server's dependencies today, so CI will skip it unless pip install -e mcp_server is added; I can add that in this PR if you'd like.

Fixes #18412

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}