25 lines
781 B
JavaScript
25 lines
781 B
JavaScript
/**
|
|
* SSE write helper with stream-injection hardening (CVE-2026-003).
|
|
*
|
|
* Every `data:` frame is JSON-stringified and newlines / U+2028 / U+2029 are
|
|
* escaped so a chunk containing `}\n\n` or other control characters cannot
|
|
* break out of the event stream and inject fake events.
|
|
*/
|
|
|
|
export function sseSafe(obj) {
|
|
return JSON.stringify(obj)
|
|
.replace(/\n/g, "\\n")
|
|
.replace(/\u2028/g, "\\u2028")
|
|
.replace(/\u2029/g, "\\u2029");
|
|
}
|
|
|
|
/**
|
|
* Write one SSE event. No-op if the response has already ended (guards the
|
|
* "write after end" error that can otherwise surface when an AI error handler
|
|
* closes the stream and the caller keeps writing).
|
|
*/
|
|
export function sseWrite(res, obj) {
|
|
if (res.writableEnded) return;
|
|
res.write(`data: ${sseSafe(obj)}\n\n`);
|
|
}
|