Skip to content

Fix quoted WebSocket extension parameters - #37314

Open
liyifan9642-creator wants to merge 1 commit into
spring-projects:mainfrom
liyifan9642-creator:fix-websocket-extension-quoted-parameters
Open

liyifan9642-creator wants to merge 1 commit into
spring-projects:mainfrom
liyifan9642-creator:fix-websocket-extension-quoted-parameters

Conversation

@liyifan9642-creator

Copy link
Copy Markdown

Closes #37284

WebSocket extension parameters may use quoted-string syntax. The current parser splits values without tracking quoted sections and leaves quoted values encoded.

This change:

  • tokenizes extension and parameter lists while respecting quoted strings and quoted-pair escapes;
  • unquotes extension parameter values;
  • enforces RFC 6455's requirement that the unescaped value conform to the token ABNF;
  • rejects malformed or unterminated quoted values.

Tests cover valid quoted values, quoted-pair unescaping, invalid decoded token values, and unterminated quoted strings.

Validation:

  • ./gradlew :spring-websocket:test
  • ./gradlew :spring-websocket:checkstyleMain :spring-websocket:checkstyleTest

All 399 spring-websocket tests pass.

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged or decided on label Sep 21, 2026
Signed-off-by: Administrator <1176316138@qq.com>
@liyifan9642-creator
liyifan9642-creator force-pushed the fix-websocket-extension-quoted-parameters branch from 0e65849 to 9818f73 Compare September 21, 2026 13:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged or decided on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Robustify WebSocketHttpHeaders.java getSecWebSocketExtensions ?

2 participants