Skip to content

Remove line terminators in eventType/id/data - #481

Merged
adamw merged 4 commits into
masterfrom
worktree-sse-line-terminators
Sep 3, 2026
Merged

Remove line terminators in eventType/id/data#481
adamw merged 4 commits into
masterfrom
worktree-sse-line-terminators

Conversation

@magdzikk

@magdzikk magdzikk commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Fixes #480.

toString could emit fields the caller never set: eventType and id were interpolated as-is, and data was split on \n only. Since the WhatWG specification treats CRLF, a lone LF and a lone CR as line terminators, any of these in a value ended the line on the wire and the remainder was parsed by the client as a new data, event, id or retry field.

  • data may legitimately span lines, so it now splits on all three terminators, each part emitted as its own data: line.
  • eventType and id cannot span lines, so terminators are removed.

Comment thread core/src/main/scala/sttp/model/sse/ServerSentEvent.scala Outdated
@adamw
adamw merged commit ba8ff8f into master Sep 3, 2026
10 checks passed
@adamw
adamw deleted the worktree-sse-line-terminators branch September 3, 2026 08:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ServerSentEvent.toString allows field injection via line terminators in eventType, id and data

2 participants