Robustify WebSocketHttpHeaders.java getSecWebSocketExtensions ?

Author: jonenstCreated Sep 16, 2026Updated Sep 16, 2026
Labelsstatus: waiting-for-triage

in https://github.com/spring-projects/spring-framework/commit/81dda069af4289395b85a6649b272b39372eb968#diff-44e75080977bfba2cfa41722ac8e0345a7ffd0bbab3893610554d2904b7935ebR102-R142

getSecWebSocketExtensions is changed from return List to List with a new parser.

It's an edge case but this custom parsing doesn't handle quotes on parameter values, just mentionning it in passing, feel free to close if appropriate

java
/**
	 * Parse the given, comma-separated string into a list of {@code WebSocketExtension} objects.
	 * <p>This method can be used to parse a "Sec-WebSocket-Extension" extensions.
	 * @param extensions the string to parse
	 * @return the list of extensions
	 * @throws IllegalArgumentException if the string cannot be parsed
	 */
	public static List<WebSocketExtension> parseExtensions(String extensions) {
		if (extensions == null || !StringUtils.hasText(extensions)) {
			return Collections.emptyList();
		}
		else {
			List<WebSocketExtension> result = new ArrayList<WebSocketExtension>();
			for(String token : extensions.split(",")) {
				result.add(parseExtension(token));
			}
			return result;
		}
	}

	private static WebSocketExtension parseExtension(String extension) {
		Assert.doesNotContain(extension, ",", "Expected a single extension value: " + extension);
		String[] parts = StringUtils.tokenizeToStringArray(extension, ";");
		String name = parts[0].trim();

		Map<String, String> parameters = null;
		if (parts.length > 1) {
			parameters = new LinkedHashMap<String, String>(parts.length - 1);
			for (int i = 1; i < parts.length; i++) {
				String parameter = parts[i];
				int eqIndex = parameter.indexOf('=');
				if (eqIndex != -1) {
					String attribute = parameter.substring(0, eqIndex);
					String value = parameter.substring(eqIndex + 1, parameter.length());
					parameters.put(attribute, value);
				}
			}
		}

		return new WebSocketExtension(name, parameters);
	}

Source: spring-projects/spring-framework