{"record":{"id":"f926ee2ded57f97a","repo":"gofiber/fiber","slug":"sse-invalid-event-w","errorCode":null,"errorMessage":"sse: invalid event: %w","messagePattern":"sse: invalid event: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"middleware/sse/event.go","lineNumber":53,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar frame bytes.Buffer\n\n\tif event.ID != \"\" {\n\t\tid, err := sanitizeField(event.ID)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sse: invalid id: %w\", err)\n\t\t}\n\t\tif id != \"\" {\n\t\t\tappendField(&frame, \"id\", id)\n\t\t}\n\t}\n\tif event.Name != \"\" {\n\t\tname, err := sanitizeField(event.Name)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sse: invalid event: %w\", err)\n\t\t}\n\t\tif name != \"\" {\n\t\t\tappendField(&frame, \"event\", name)\n\t\t}\n\t}\n\tif event.Retry > 0 {\n\t\tappendField(&frame, \"retry\", utils.FormatInt(event.Retry.Milliseconds()))\n\t}\n\tif data.hasData {\n\t\tappendData(&frame, data.data)\n\t}\n\tframe.WriteByte('\\n') //nolint:errcheck // bytes.Buffer writes never fail.\n\tif _, err := w.Write(frame.Bytes()); err != nil {\n\t\treturn fmt.Errorf(\"sse: write event: %w\", err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/gofiber/fiber/blob/a105acad6c1e4576a77f01e02973f67e962bb58d/middleware/sse/event.go#L35-L71","documentation":"Thrown by writeEvent when sanitizeField rejects the Event.Name (the SSE 'event' field / custom event type) because it contains a CR or LF. Same wire-format protection as error 206, applied to the event name instead of the id.","triggerScenarios":"Setting Event.Name to a value containing a newline or carriage return — e.g. building the event name from user input that was not sanitized, or from a multi-line template.","commonSituations":"Dynamic event names derived from message topics, log lines, or user input that happen to contain newlines; copy-paste introducing stray \\n.","solutions":["Restrict event names to single-line tokens (letters, digits, '-', '_', '.').","Sanitize/whitelist the name before assigning it to Event.Name.","Use a fixed vocabulary of event names rather than free-form input."],"exampleFix":"// before\nstream.Event(sse.Event{Name: topicFromUser, Data: payload})\n\n// after\nname := strings.Map(func(r rune) rune {\n    if r == '\\n' || r == '\\r' { return -1 }\n    return r\n}, topicFromUser)\nstream.Event(sse.Event{Name: name, Data: payload})","handlingStrategy":"validation","validationCode":"func safeSSEName(name string) string {\n    return strings.Map(func(r rune) rune {\n        if r == '\\n' || r == '\\r' { return -1 }\n        return r\n    }, name)\n}","typeGuard":"func isValidSSEEventName(s string) bool {\n    if s == \"\" { return false }\n    for _, r := range s {\n        if r == '\\n' || r == '\\r' { return false }\n    }\n    return true\n}","tryCatchPattern":"if !isValidSSEEventName(name) {\n    name = \"message\" // safe default\n}\nstream.Event(sse.Event{Name: name, Data: payload})","preventionTips":["Whitelist event names to a fixed vocabulary built from trusted constants.","Never derive event names from unsanitized user input.","Unit-test your event-emission helper with newline-bearing inputs."],"tags":["sse","validation","wire-format"],"backgroundTag":null,"analyzedSha":"a105acad6c1e4576a77f01e02973f67e962bb58d","analyzedAt":"2026-08-11T17:33:26.942Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}