fix(admin): normalize CRLF to LF before escaping in SSE log streams

Replace \r\n and \r with \n before escaping newlines to prevent
SSE injection from mixed line endings in log lines.

Applies to both streamProcessLogs and streamContainerLogs.

commit: 31e383c7b41ee429cbaf14266f32a9cac8a9893a
author: bnema · 8mo ago · 2026-02-01 15:04 UTC
parent: b9c783f
signature: unsigned

1 file · +11 -4

M internal/adapters/in/http/admin/handler.go +11 -4


@@ -893,9 +893,12 @@ func (h Handler) streamProcessLogs(w http.ResponseWriter, r http.Request, line
893	893		if !ok {
894	894		return
895	895		}
896		-	// SECURITY: Escape newlines in log lines to prevent SSE event injection.
	896	+	// SECURITY: Normalize line endings and escape newlines in log lines to prevent SSE event injection.
	897	+	// First normalize CRLF (\r\n) and CR (\r) to LF (\n), then escape newlines.
897	898		// Per the SSE spec, multi-line data must use separate "data:" prefixes.
898		-	escaped := strings.ReplaceAll(line, "\n", "\ndata: ")
	899	+	normalized := strings.ReplaceAll(line, "\r\n", "\n")
	900	+	normalized = strings.ReplaceAll(normalized, "\r", "\n")
	901	+	escaped := strings.ReplaceAll(normalized, "\n", "\ndata: ")
899	902		_, _ = fmt.Fprintf(w, "data: %s\n\n", escaped)
900	903		flusher.Flush()
901	904		case <-ctx.Done():

@@ -936,8 +939,12 @@ func (h Handler) streamContainerLogs(w http.ResponseWriter, r http.Request, lo
936	939		if !ok {
937	940		return
938	941		}
939		-	// SECURITY: Escape newlines in log lines to prevent SSE event injection.
940		-	escaped := strings.ReplaceAll(line, "\n", "\ndata: ")
	942	+	// SECURITY: Normalize line endings and escape newlines in log lines to prevent SSE event injection.
	943	+	// First normalize CRLF (\r\n) and CR (\r) to LF (\n), then escape newlines.
	944	+	// Per the SSE spec, multi-line data must use separate "data:" prefixes.
	945	+	normalized := strings.ReplaceAll(line, "\r\n", "\n")
	946	+	normalized = strings.ReplaceAll(normalized, "\r", "\n")
	947	+	escaped := strings.ReplaceAll(normalized, "\n", "\ndata: ")
941	948		_, _ = fmt.Fprintf(w, "data: %s\n\n", escaped)
942	949		flusher.Flush()
943	950		case <-ctx.Done():

 			if !ok {
 				return
 			}
-			// SECURITY: Escape newlines in log lines to prevent SSE event injection.
+			// SECURITY: Normalize line endings and escape newlines in log lines to prevent SSE event injection.
+			// First normalize CRLF (\r\n) and CR (\r) to LF (\n), then escape newlines.
 			// Per the SSE spec, multi-line data must use separate "data:" prefixes.
-			escaped := strings.ReplaceAll(line, "\n", "\ndata: ")
+			normalized := strings.ReplaceAll(line, "\r\n", "\n")
+			normalized = strings.ReplaceAll(normalized, "\r", "\n")
+			escaped := strings.ReplaceAll(normalized, "\n", "\ndata: ")
 			_, _ = fmt.Fprintf(w, "data: %s\n\n", escaped)
 			flusher.Flush()
 		case <-ctx.Done():
 			if !ok {
 				return
 			}
-			// SECURITY: Escape newlines in log lines to prevent SSE event injection.
+			// SECURITY: Normalize line endings and escape newlines in log lines to prevent SSE event injection.
-			escaped := strings.ReplaceAll(line, "\n", "\ndata: ")
+			// First normalize CRLF (\r\n) and CR (\r) to LF (\n), then escape newlines.
+			// Per the SSE spec, multi-line data must use separate "data:" prefixes.
+			normalized := strings.ReplaceAll(line, "\r\n", "\n")
+			normalized = strings.ReplaceAll(normalized, "\r", "\n")
+			escaped := strings.ReplaceAll(normalized, "\n", "\ndata: ")
 			_, _ = fmt.Fprintf(w, "data: %s\n\n", escaped)
 			flusher.Flush()
 		case <-ctx.Done():