Guard against invalid id/event values in Server Sent Events

Prior to this commit, our implementation of Server Sent Events (SSE),
`SseEmitter` (MVC) and `ServerSentEvent` (WebFlux), would not guard
against invalid characters if the application mistakenly inserts such
characters in the `id` or `event` types.
Both implementations would also behave differently when it comes
to escaping comment multi-line events.

This commit ensures that both implementations handle multi-line comment
events and reject invalid characters in id/event types.
This commit also optimizes `String` concatenation and memory usage
when writing data.

Fixes gh-36440

spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitterTests.java

@@ -22,14 +22,19 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Set;
 import java.util.function.Consumer;
+import java.util.stream.Stream;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
 
 import org.springframework.http.MediaType;
 import org.springframework.lang.Nullable;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.springframework.web.servlet.mvc.method.annotation.SseEmitter.event;
 
 
@@ -105,9 +110,10 @@ class SseEmitterTests {
 		this.handler.assertWriteCount(1);
 	}
 
-	@Test
-	void sendEventWithMultiline() throws Exception {
-		this.emitter.send(event().data("foo\nbar\nbaz"));
+	@ParameterizedTest(name = "{1}")
+	@MethodSource("newLineCharacters")
+	void sendEventWithMultiline(String newLineChars, String description) throws Exception {
+		this.emitter.send(event().data("foo" + newLineChars + "bar" + newLineChars + "baz"));
 		this.handler.assertSentObjectCount(3);
 		this.handler.assertObject(0, "data:", TEXT_PLAIN_UTF8);
 		this.handler.assertObject(1, "foo\ndata:bar\ndata:baz");
@@ -115,6 +121,17 @@ class SseEmitterTests {
 		this.handler.assertWriteCount(1);
 	}
 
+	@ParameterizedTest(name = "{1}")
+	@MethodSource("newLineCharacters")
+	void sendEventWithMultilineWithMediaType(String newLineChars, String description) throws Exception {
+		this.emitter.send(event().data("foo" + newLineChars + "bar" + newLineChars + "baz", MediaType.TEXT_PLAIN));
+		this.handler.assertSentObjectCount(3);
+		this.handler.assertObject(0, "data:", TEXT_PLAIN_UTF8);
+		this.handler.assertObject(1, "foo\ndata:bar\ndata:baz", MediaType.TEXT_PLAIN);
+		this.handler.assertObject(2, "\n\n", TEXT_PLAIN_UTF8);
+		this.handler.assertWriteCount(1);
+	}
+
 	@Test
 	void sendEventFull() throws Exception {
 		this.emitter.send(event().comment("blah").name("test").reconnectTime(5000L).id("1").data("foo"));
@@ -137,6 +154,28 @@ class SseEmitterTests {
 		this.handler.assertWriteCount(1);
 	}
 
+	@ParameterizedTest(name = "{1}")
+	@MethodSource("newLineCharacters")
+	void rejectInvalidId(String newLineChars, String description) {
+		assertThatIllegalArgumentException().isThrownBy(() -> this.emitter
+				.send(event().id("first" + newLineChars + "second")));
+	}
+
+	@ParameterizedTest(name = "{1}")
+	@MethodSource("newLineCharacters")
+	void rejectInvalidName(String newLineChars, String description) {
+		assertThatIllegalArgumentException().isThrownBy(() -> this.emitter
+				.send(event().name("first" + newLineChars + "second")));
+	}
+
+	private static Stream<Arguments> newLineCharacters() {
+		return Stream.of(
+				Arguments.of("\n", "LF"),
+				Arguments.of("\r", "CR"),
+				Arguments.of("\r\n", "CRLF")
+		);
+	}
+
 
 	private static class TestHandler implements ResponseBodyEmitter.Handler {