Use replacement character for invalid UTF-8 and handle null bytes

Author: clue

src/MessageEvent.php

@@ -29,11 +29,11 @@ public static function parse($data, $lastEventId, &$retryTime = 0.0)
                 $value = (string) substr($value, 1);
             }
             if ($name === 'data') {
-                $data .= $value . "\n";
-            } elseif ($name === 'id') {
-                $id = $value;
+                $data .= self::utf8($value) . "\n";
+            } elseif ($name === 'id' && \strpos($value, "\x00") === false) {
+                $id = self::utf8($value);
             } elseif ($name === 'event' && $value !== '') {
-                $type = $value;
+                $type = self::utf8($value);
             } elseif ($name === 'retry' && $value === (string)(int)$value && $value >= 0) {
                 $retryTime = $value * 0.001;
             }
@@ -46,6 +46,12 @@ public static function parse($data, $lastEventId, &$retryTime = 0.0)
         return new self($data, $id, $type);
     }
 
+    /** @return string */
+    private static function utf8($string)
+    {
+        return \htmlspecialchars_decode(\htmlspecialchars($string, \ENT_NOQUOTES | \ENT_SUBSTITUTE, 'utf-8'));
+    }
+
     /**
      * @internal
      * @param string $data

tests/MessageEventTest.php

@@ -56,6 +56,13 @@ public function testParseDataWithCarrigeReturnAndNewlineOverTwoLines()
         $this->assertEquals("hello\n", $message->data);
     }
 
+    public function testParseDataWithNonUtf8AndNullBytesReturnsDataWithUnicodeReplacement()
+    {
+        $message = MessageEvent::parse("data: h\x00ll\xFF!", '');
+
+        $this->assertEquals("h\x00ll�!", $message->data);
+    }
+
     public function testParseReturnsMessageWithIdFromStream()
     {
         $message = MessageEvent::parse("data: hello\r\nid: 1", '');
@@ -88,6 +95,22 @@ public function testParseWithMultipleIdsReturnsMessageWithLastEventIdFromStream(
         $this->assertEquals('2', $message->lastEventId);
     }
 
+    public function testParseWithIdWithNonUtf8BytesReturnsMessageWithLastEventIdFromStreamWithUnicodeReplacement()
+    {
+        $message = MessageEvent::parse("data: hello\nid: h\xFFllo!", '');
+
+        $this->assertEquals("hello", $message->data);
+        $this->assertEquals("h�llo!", $message->lastEventId);
+    }
+
+    public function testParseWithIdWithNullByteReturnsMessageWithLastEventIdFromLastEventId()
+    {
+        $message = MessageEvent::parse("data: hello\nid: h\x00llo!", '1');
+
+        $this->assertEquals("hello", $message->data);
+        $this->assertEquals('1', $message->lastEventId);
+    }
+
     public function testParseReturnsMessageWithTypeFromStream()
     {
         $message = MessageEvent::parse("data: hello\r\nevent: join", '');
@@ -120,6 +143,14 @@ public function testParseWithEmptyEventReturnsMessageWithDefaultMessageType()
         $this->assertEquals('message', $message->type);
     }
 
+    public function testParseWithEventTypeWithNonUtf8AndNullBytesReturnsTypeWithUnicodeReplacement()
+    {
+        $message = MessageEvent::parse("data: hello\nevent: h\x00ll\xFF!", '');
+
+        $this->assertEquals("hello", $message->data);
+        $this->assertEquals("h\x00ll�!", $message->type);
+    }
+
     public function retryTimeDataProvider()
     {
         return [