06eccbf077
fix: add null-byte protection to SSE 'event' field for symmetry with 'id'
`_check_event_no_newline` lacked a `\0` check that `_check_id_no_null_or_newline`
has had since the original implementation. Similarly, `format_sse_event()` stripped
`\0` from `id` but not from `event`.
Changes:
- Extend `_check_event_no_newline` to also reject `\0` characters
- Strip `\0` in `format_sse_event()` for `event` (mirrors existing `id` behavior)
- Add `test_server_sent_event_null_event_rejected` regression test
`event` and `id` are now fully symmetric in both the model validator and the
low-level wire formatter.
4 months ago
8bfab526a2
fix: reject newline characters in SSE event and id fields
`format_sse_event()` interpolated the `event` and `id` fields into SSE
wire-format bytes without stripping or rejecting newline characters. A
`\n` or `\r\n` in either field injects an additional SSE field-line into
the stream — enabling event-type spoofing and fabricated data payloads
in browser EventSource clients.
The `data` and `comment` fields were already protected via `splitlines()`;
the omission for `event` and `id` was an inconsistency, not a design
decision. The identical bug class was fixed in Hono (GHSA-p6xx-57qc-3wxr).
Changes:
- Add `_check_event_no_newline()` validator and apply it to
`ServerSentEvent.event` via `AfterValidator`
- Extend `_check_id_no_null()` to also reject `\n` and `\r`
- Strip `\r`/`\n` in `format_sse_event()` for `event` and `id` as
defense-in-depth (low-level function, bypasses model validators)
- Add 7 regression tests covering LF/CR rejection in both the model
and the low-level formatting function
Severity: Medium (client-side injection; server unaffected)
CWE: CWE-116 — Improper Encoding for Output in a Different Plaintext Context
OWASP: A03:2021 — Injection
Prior art: Hono GHSA-p6xx-57qc-3wxr (same class, same fix pattern)
4 months ago
64feaec802
📝 Update release notes
[skip ci]
4 months ago
12bbd9453f
🌐 Update translations for zh (update-outdated) ( #15177 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
453988f359
📝 Update release notes
[skip ci]
4 months ago
fe98ea307a
🌐 Update translations for zh-hant (update-outdated) ( #15178 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
b7bd1874fe
📝 Update release notes
[skip ci]
4 months ago
602ddc2e51
⬆ Bump authlib from 1.6.7 to 1.6.9 ( #15128 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Sofie Van Landeghem <[email protected] >
4 months ago
30bd2d5878
📝 Update release notes
[skip ci]
4 months ago
a4e005c140
📝 Update release notes
[skip ci]
4 months ago
6cd66ace1c
⬆ Bump pyasn1 from 0.6.2 to 0.6.3 ( #15143 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
4 months ago
2fba244c3a
⬆ Bump ujson from 5.11.0 to 5.12.0 ( #15150 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
4 months ago
6cd1a2c75d
📝 Update release notes
[skip ci]
4 months ago
df4417efa5
🌐 Update translations for zh-hant (add-missing) ( #15176 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
1122d37676
📝 Update release notes
[skip ci]
4 months ago
5ef5490bc4
🌐 Update translations for zh (add-missing) ( #15175 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
b4f81b40a8
📝 Update release notes
[skip ci]
4 months ago
311ce1cfa5
🌐 Update translations for ja (update-outdated) ( #15171 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
92cc0bd9de
📝 Update release notes
[skip ci]
4 months ago
7e63d4250a
🌐 Update translations for ko (update-outdated) ( #15170 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
9d6ee88e8f
📝 Update release notes
[skip ci]
4 months ago
d90c38572b
🌐 Update translations for tr (update-outdated) ( #15172 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
a28b785ed7
📝 Update release notes
[skip ci]
4 months ago
07dfa9a5ae
🌐 Update translations for ko (add-missing) ( #15168 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
019471bc6c
📝 Update release notes
[skip ci]
4 months ago
bd1305c796
🌐 Update translations for ja (add-missing) ( #15167 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
bdb0b2d6dd
📝 Update release notes
[skip ci]
4 months ago
f00bd2be07
🌐 Update translations for tr (add-missing) ( #15169 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
aa62c2f8df
📝 Update release notes
[skip ci]
4 months ago
fdf31c110b
🌐 Update translations for fr (update-outdated) ( #15165 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
c457177969
📝 Update release notes
[skip ci]
4 months ago
98d3f9a2e8
🌐 Update translations for fr (add-missing) ( #15163 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
fe5332fbed
📝 Update release notes
[skip ci]
4 months ago
f97b72a754
🌐 Update translations for uk (update-outdated) ( #15160 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
7451444663
📝 Update release notes
[skip ci]
4 months ago
dc689a9ee3
🌐 Update translations for uk (add-missing) ( #15158 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
9671f78d29
📝 Update release notes
[skip ci]
4 months ago
9dc22c3f1d
📝 Update release notes
[skip ci]
4 months ago
40301c86ee
🌐 Update translations for pt (update-outdated) ( #15159 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
06cdff4488
🌐 Update translations for pt (add-missing) ( #15157 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
2742546af6
📝 Update release notes
[skip ci]
4 months ago
869de156e8
🌐 Update translations for es (update-outdated) ( #15155 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
75e5fdfef8
📝 Update release notes
[skip ci]
4 months ago
cd5869b897
🌐 Update translations for es (add-missing) ( #15154 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
b61bdb79b8
📝 Update release notes
[skip ci]
4 months ago
63f89410ed
🌐 Update translations for de (update-outdated) ( #15156 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
ab1a792b70
📝 Update release notes
[skip ci]
4 months ago
12cf2bd854
🌐 Update translations for ru (update-and-add) ( #15152 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
4 months ago
48f8e87691
📝 Update release notes
[skip ci]
4 months ago
96beaeb167
🌐 Update translations for de (add-missing) ( #15153 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
4 months ago
Subhash Dasyam
github-actions[bot]
Sebastián Ramírez
dependabot[bot]