Skip to content

Remove line terminators in eventType/id/data - #481

Open
magdzikk wants to merge 4 commits into
masterfrom
worktree-sse-line-terminators
Open

Remove line terminators in eventType/id/data#481
magdzikk wants to merge 4 commits into
masterfrom
worktree-sse-line-terminators

Conversation

@magdzikk

@magdzikk magdzikk commented Sep 1, 2026

Copy link
Copy Markdown

Fixes #480.

toString could emit fields the caller never set: eventType and id were interpolated as-is, and data was split on \n only. Since the WhatWG specification treats CRLF, a lone LF and a lone CR as line terminators, any of these in a value ended the line on the wire and the remainder was parsed by the client as a new data, event, id or retry field.

  • data may legitimately span lines, so it now splits on all three terminators, each part emitted as its own data: line.
  • eventType and id cannot span lines, so terminators are removed.

Comment thread core/src/main/scala/sttp/model/sse/ServerSentEvent.scala Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ServerSentEvent.toString allows field injection via line terminators in eventType, id and data

2 participants