diff --git a/fastapi/sse.py b/fastapi/sse.py index 7e7ac671c4..37468ff582 100644 --- a/fastapi/sse.py +++ b/fastapi/sse.py @@ -43,8 +43,11 @@ def _check_id_no_null_or_newline(v: str | None) -> str | None: def _check_event_no_newline(v: str | None) -> str | None: - if v is not None and ("\n" in v or "\r" in v): - raise ValueError("SSE 'event' must not contain newline characters") + if v is not None: + if "\0" in v: + raise ValueError("SSE 'event' must not contain null characters") + if "\n" in v or "\r" in v: + raise ValueError("SSE 'event' must not contain newline characters") return v @@ -209,7 +212,7 @@ def format_sse_event( lines.append(f": {line}") if event is not None: - event = event.replace("\r", "").replace("\n", "") + event = event.replace("\r", "").replace("\n", "").replace("\0", "") lines.append(f"event: {event}") if data_str is not None: diff --git a/tests/test_sse.py b/tests/test_sse.py index 5f1ae85e37..467c6d8b77 100644 --- a/tests/test_sse.py +++ b/tests/test_sse.py @@ -221,6 +221,11 @@ def test_server_sent_event_null_id_rejected(): ServerSentEvent(data="test", id="has\0null") +def test_server_sent_event_null_event_rejected(): + with pytest.raises(ValueError, match="null"): + ServerSentEvent(data="test", event="has\0null") + + def test_server_sent_event_newline_event_rejected(): with pytest.raises(ValueError, match="newline"): ServerSentEvent(data="test", event="chat\npwned")