fix(sse): sanitize newlines in event stream fields to prevent SSE injection

Author: pi0

src/utils/sse/utils.ts

@@ -7,18 +7,26 @@ import { EventStreamMessage } from "./types";
 export function formatEventStreamMessage(message: EventStreamMessage): string {
   let result = "";
   if (message.id) {
-    result += `id: ${message.id}\n`;
+    result += `id: ${_sanitizeSingleLine(message.id)}\n`;
   }
   if (message.event) {
-    result += `event: ${message.event}\n`;
+    result += `event: ${_sanitizeSingleLine(message.event)}\n`;
   }
   if (typeof message.retry === "number" && Number.isInteger(message.retry)) {
     result += `retry: ${message.retry}\n`;
   }
-  result += `data: ${message.data}\n\n`;
+  const data = typeof message.data === "string" ? message.data : "";
+  for (const line of data.split("\n")) {
+    result += `data: ${line}\n`;
+  }
+  result += "\n";
   return result;
 }
 
+function _sanitizeSingleLine(value: string): string {
+  return value.replace(/[\n\r]/g, "");
+}
+
 export function formatEventStreamMessages(
   messages: EventStreamMessage[],
 ): string {

test/sse.test.ts

@@ -122,3 +122,40 @@ it("properly formats multiple sse messages", () => {
   ]);
   expect(result).toEqual(`data: hello world\n\nid: 1\ndata: hello world 2\n\n`);
 });
+
+it("sanitizes newlines in event field to prevent SSE injection", () => {
+  const result = formatEventStreamMessage({
+    event: "message\nevent: admin\ndata: INJECTED",
+    data: "legit",
+  });
+  expect(result).toEqual(
+    `event: messageevent: admindata: INJECTED\ndata: legit\n\n`,
+  );
+  expect(result.split("\n").filter((l) => l.startsWith("event:")).length).toBe(
+    1,
+  );
+});
+
+it("sanitizes newlines in id field to prevent SSE injection", () => {
+  const result = formatEventStreamMessage({
+    id: "1\ndata: INJECTED",
+    data: "legit",
+  });
+  expect(result).toEqual(`id: 1data: INJECTED\ndata: legit\n\n`);
+});
+
+it("splits multi-line data into separate data fields", () => {
+  const result = formatEventStreamMessage({
+    data: "line1\nline2\nline3",
+  });
+  expect(result).toEqual(`data: line1\ndata: line2\ndata: line3\n\n`);
+});
+
+it("prevents data field injection of new events", () => {
+  const result = formatEventStreamMessage({
+    data: "hi\n\nevent: system\ndata: INJECTED",
+  });
+  expect(result).toBe(
+    `data: hi\ndata: \ndata: event: system\ndata: data: INJECTED\n\n`,
+  );
+});