The choice to ignore or reject non-null trailing padding bits is really implementation dependent.

Python and Zig reject invalid padding.

PHP's base64_decode() function accepts it, but the sodium_base642bin() function doesn't.

Since Rust doesn't have base64 support, it depends on the crate being used. The ct-codecs crate rejects invalid padding, the base64 crate doesn't.

So... it depends.

But that issue is well known, and I think most modern implementations reject invalid padding. And in the context of cryptographic operations, you are supposed to use codecs from the cryptographic libraries you are using anyway. These implementations avoid side channels, and, of course, reject non-canonical encodings.