StompDecoder fails for partial headers containing escape sequence [SPR-13416]

[spring-projects-issues]

Michael Kötter opened SPR-13416 and commented

We encountered frequent disconnects in our STOMP-Websocket application and traced the issue to the following exceptions occuring in StompDecoder:

org.springframework.messaging.simp.stomp.StompConversionException: Illegal escape sequence at index 2: ID\
..
org.springframework.messaging.simp.stomp.StompConversionException: Illegal escape sequence at index 41: ID\cf9677c70d5f4-59973-1440685240095-7\c1\

StompDecoder seems to decode the message in chunks, which is fine as long as the chunk doesn't end right after the start of an escape sequence in the header (as is the case with the above exceptions).

This is related to #17025, which doesn't really fix the root cause - the message header is not necessarily invalid because it ends with "", it's just incomplete, and the next chunk would probably contain the remaining bits.

Attached is a patch with proposed fix (only parses headers after an EOL was encountered) and test case to reproduce the issue.

---

Affects: 4.1.7, 4.2 GA

Attachments:

• issue.patch (3.82 kB)

Issue Links:

• StompDecoder StringIndexOutOfBoundsException with Apache ActiveMQ [SPR-12418] #17025 StompDecoder StringIndexOutOfBoundsException with Apache ActiveMQ
• Stomp version 1.1 and 1.2 allows headers with empty values [SPR-13111] #17702 Stomp version 1.1 and 1.2 allows headers with empty values

Referenced from: commits 4428c34, daa49c9

Backported to: 4.1.8

[spring-projects-issues]

Rossen Stoyanchev commented

Indeed looking at the example in #17025 it's either an "" at the end of an incomplete frame in which case it can be ignored or a legal escape sequence like "\c" (i.e. ":").