fix: Fix SSE corrupted data by pavel-jares-bcm · Pull Request #4530 · zowe/api-layer

pavel-jares-bcm · 2026-03-26T23:10:30Z

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

Linked to # (issue)
Part of the # (epic)

Type of change

Please delete options that are not relevant.

fix: Bug fix (non-breaking change which fixes an issue)
feat: New feature (non-breaking change which adds functionality)
docs: Change in a documentation
refactor: Refactor the code
chore: Chore, repository cleanup, updates the dependencies.
BREAKING CHANGE or !: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

My code follows the style guidelines of this project
PR title conforms to commit message guideline ## Commit Message Structure Guideline
I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
The java tests in the area I was working on leverage @nested annotations
Any dependent changes have been merged and published in downstream modules

For more details about how should the code look like read the Contributing guideline

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

pablocarle · 2026-03-27T12:19:23Z

Description of the PR? Maybe you can link to the upstream fix?

iansergeant42

Comment left as I can't request changes

iansergeant42 · 2026-03-31T10:45:41Z

gateway-service/src/main/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandler.java

+        @Override
+        public SseEventBuilderFixedImpl id(String id) {
+            checkEvent(id);
+            append("id:").append(id).append('\n');


Literal \n is used a lot. Can it be a constant?

It is following the original implementation to be easier to maintain.

iansergeant42 · 2026-03-31T10:45:50Z

gateway-service/src/main/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandler.java

-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
+import java.util.*;


Idea has removed imports again. Concern as with the previous PR.

iansergeant42 · 2026-03-31T10:48:45Z

gateway-service/src/main/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandler.java

+
+        private static void checkEvent(String content) {
+            Assert.isTrue(content.indexOf('\n') == -1 && content.indexOf('\r') == -1,
+                "illegal character '\\n' or '\\r' in event content");


This is inconsistent with what is on lines 174 and 175. Can we please make them consistent, and use a constant?

It is following the original implementation to be easier to maintain.

iansergeant42 · 2026-03-31T10:49:56Z

gateway-service/src/main/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandler.java

+                    char c = input.charAt(i);
+                    if (c == '\r') {
+                        if (i + 1 < length && input.charAt(i + 1) == '\n') {
+                            i++;


Sonar doesn't like the incrementation of the counter within the loop.

It is following the original implementation to be easier to maintain.

iansergeant42 · 2026-03-31T10:50:47Z

gateway-service/src/test/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandlerTest.java

+            @Mock
+            private SseEmitter emitter;
+
+            @Test


SneakyThrows is neater

I don't see any benefit. If the exception is thrown it is good to have the stack trace.

iansergeant42 · 2026-03-31T10:52:46Z

gateway-service/src/test/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandlerTest.java

+                java.util.function.Consumer<ServerSentEvent<String>> consumer = new ServerSentEventProxyHandler(null, null)
+                    .consumer(emitter);
+
+                assertThrows(IllegalArgumentException.class, () -> consumer.accept(event));


Can we add the expected message for clarity?

iansergeant42 · 2026-03-31T10:53:11Z

gateway-service/src/test/java/org/zowe/apiml/gateway/sse/ServerSentEventProxyHandlerTest.java

+                java.util.function.Consumer<ServerSentEvent<String>> consumer = new ServerSentEventProxyHandler(null, null)
+                    .consumer(emitter);
+
+                assertThrows(IllegalArgumentException.class, () -> consumer.accept(event));


Ditto regarding message

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

sonarqubecloud · 2026-04-08T09:13:27Z

Quality Gate failed

Failed conditions
71.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

pavel-jares-bcm added 3 commits March 26, 2026 17:42

draft of fix

0d09ba7

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

draft of fix

51cf8ba

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

tests

446c386

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

github-project-automation bot added this to API Mediation Layer Backlog Management Mar 26, 2026

github-project-automation bot moved this to New in API Mediation Layer Backlog Management Mar 26, 2026

pull-request-size bot added the size/L label Mar 26, 2026

pavel-jares-bcm and others added 3 commits March 27, 2026 09:22

fix Sonar

c834af5

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

Merge branch 'v2.x.x' into reboot/cve-2026-22735

40560ec

Merge branch 'v2.x.x' into reboot/cve-2026-22735

b091bb1

pavel-jares-bcm added 2 commits March 27, 2026 16:53

Merge branch 'v2.x.x' into reboot/cve-2026-22735

26936a0

Merge branch 'v2.x.x' into reboot/cve-2026-22735

280aeb6

iansergeant42 reviewed Mar 31, 2026

View reviewed changes

EvaJavornicka moved this from New to In Progress in API Mediation Layer Backlog Management Apr 1, 2026

pavel-jares-bcm and others added 3 commits April 7, 2026 12:28

code review

92e4cb7

Signed-off-by: Pavel Jareš <Pavel.Jares@broadcom.com>

Merge branch 'v2.x.x' into reboot/cve-2026-22735

641163e

Merge branch 'v2.x.x' into reboot/cve-2026-22735

20dbcde

Merge branch 'v2.x.x' into reboot/cve-2026-22735

443fc08

Conversation

pavel-jares-bcm commented Mar 26, 2026

Description

Type of change

Checklist:

Uh oh!

pablocarle commented Mar 27, 2026

Uh oh!

iansergeant42 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Apr 8, 2026

Quality Gate failed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants