From ecfa498ea9647ba5d3971121df5c97b6d7772abd Mon Sep 17 00:00:00 2001 From: Brian Clozel Date: Wed, 3 Jun 2026 11:13:32 +0200 Subject: [PATCH] Support multi-line comments in Server Sent Events Prior to this commit, comments sent with Server Sent Events could break the wire format when sent over the network when comments contained line breaks. While comments are mainly used for sending keepalive messages, they can also be used for sending debug data. This commit ensures that line breaks are properly handled in comments. Fixes gh-36866 --- .../http/codec/ServerSentEvent.java | 29 +++++++++++++++++-- .../http/codec/ServerSentEventTests.java | 8 +++++ .../mvc/method/annotation/SseEmitter.java | 21 ++++++++++---- .../method/annotation/SseEmitterTests.java | 11 +++++++ 4 files changed, 62 insertions(+), 7 deletions(-) diff --git a/spring-web/src/main/java/org/springframework/http/codec/ServerSentEvent.java b/spring-web/src/main/java/org/springframework/http/codec/ServerSentEvent.java index dc90690e711..3ccccd9519c 100644 --- a/spring-web/src/main/java/org/springframework/http/codec/ServerSentEvent.java +++ b/spring-web/src/main/java/org/springframework/http/codec/ServerSentEvent.java @@ -21,7 +21,6 @@ import java.time.Duration; import org.springframework.lang.Nullable; import org.springframework.util.Assert; import org.springframework.util.ObjectUtils; -import org.springframework.util.StringUtils; /** * Representation for a Server-Sent Event for use with Spring's reactive Web support. @@ -121,7 +120,9 @@ public final class ServerSentEvent { appendAttribute("retry", this.retry.toMillis(), sb); } if (this.comment != null) { - sb.append(':').append(StringUtils.replace(this.comment, "\n", "\n:")).append('\n'); + sb.append(':'); + appendEscaped(this.comment, "\n:", sb); + sb.append('\n'); } if (this.data != null) { sb.append("data:"); @@ -133,6 +134,30 @@ public final class ServerSentEvent { sb.append(fieldName).append(':').append(fieldValue).append('\n'); } + private void appendEscaped(String input, String replacement, StringBuilder sb) { + if (input.indexOf('\n') == -1 && input.indexOf('\r') == -1) { + sb.append(input); + } + else { + int length = input.length(); + for (int i = 0; i < length; i++) { + char c = input.charAt(i); + if (c == '\r') { + if (i + 1 < length && input.charAt(i + 1) == '\n') { + i++; + } + sb.append(replacement); + } + else if (c == '\n') { + sb.append(replacement); + } + else { + sb.append(c); + } + } + } + } + @Override public boolean equals(@Nullable Object other) { return (this == other || (other instanceof ServerSentEvent that && diff --git a/spring-web/src/test/java/org/springframework/http/codec/ServerSentEventTests.java b/spring-web/src/test/java/org/springframework/http/codec/ServerSentEventTests.java index 7d6f1b4d9a5..b2d35df4c77 100644 --- a/spring-web/src/test/java/org/springframework/http/codec/ServerSentEventTests.java +++ b/spring-web/src/test/java/org/springframework/http/codec/ServerSentEventTests.java @@ -58,6 +58,14 @@ class ServerSentEventTests { assertThat(event.format()).contains("id:42").doesNotContain("event"); } + @ParameterizedTest(name = "{1}") + @MethodSource("newLineCharacters") + void supportMultiLineComments(String newLine, String description) { + ServerSentEvent event = ServerSentEvent.builder() + .comment("foo" + newLine + "bar" + newLine + "baz").data("payload").build(); + assertThat(event.format()).isEqualTo(":foo\n:bar\n:baz\ndata:"); + } + private static Stream newLineCharacters() { return Stream.of( Arguments.of("\n", "LF"), diff --git a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java index 94be3f280c5..5cbb01c8d0f 100644 --- a/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java +++ b/spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java @@ -223,7 +223,9 @@ public class SseEmitter extends ResponseBodyEmitter { @Override public SseEventBuilder comment(String comment) { - append(':').append(StringUtils.replace(comment, "\n", "\n:")).append('\n'); + append(':'); + appendEscaped(comment, "\n:"); + append('\n'); return this; } @@ -258,6 +260,16 @@ public class SseEmitter extends ResponseBodyEmitter { if (input.indexOf('\n') == -1 && input.indexOf('\r') == -1) { this.dataToSend.add(new DataWithMediaType(input, mediaType)); } + else { + appendEscaped(input, "\ndata:"); + saveAppendedText(mediaType); + } + } + + private void appendEscaped(String input, String replacement) { + if (input.indexOf('\n') == -1 && input.indexOf('\r') == -1) { + append(input); + } else { int length = input.length(); for (int i = 0; i < length; i++) { @@ -266,16 +278,15 @@ public class SseEmitter extends ResponseBodyEmitter { if (i + 1 < length && input.charAt(i + 1) == '\n') { i++; } - this.sb.append("\ndata:"); + append(replacement); } else if (c == '\n') { - this.sb.append("\ndata:"); + append(replacement); } else { - this.sb.append(c); + append(c); } } - saveAppendedText(mediaType); } } diff --git a/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitterTests.java b/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitterTests.java index 3c86732eba7..4541a9b7863 100644 --- a/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitterTests.java +++ b/spring-webmvc/src/test/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitterTests.java @@ -168,6 +168,17 @@ class SseEmitterTests { .send(event().name("first" + newLineChars + "second"))); } + @ParameterizedTest(name = "{1}") + @MethodSource("newLineCharacters") + void supportMultiLineComments(String newLineChars, String description) throws Exception { + this.emitter.send(event().comment("foo" + newLineChars + "bar" + newLineChars + "baz").data("payload")); + this.handler.assertSentObjectCount(3); + this.handler.assertObject(0, ":foo\n:bar\n:baz\ndata:", TEXT_PLAIN_UTF8); + this.handler.assertObject(1, "payload"); + this.handler.assertObject(2, "\n\n", TEXT_PLAIN_UTF8); + this.handler.assertWriteCount(1); + } + private static Stream newLineCharacters() { return Stream.of( Arguments.of("\n", "LF"),