Robustify WebSocketHttpHeaders.java getSecWebSocketExtensions ?
Author: jonenstCreated Sep 16, 2026Updated Sep 16, 2026
Labelsstatus: waiting-for-triage
getSecWebSocketExtensions is changed from return List to List with a new parser.
It's an edge case but this custom parsing doesn't handle quotes on parameter values, just mentionning it in passing, feel free to close if appropriate
/**
* Parse the given, comma-separated string into a list of {@code WebSocketExtension} objects.
* <p>This method can be used to parse a "Sec-WebSocket-Extension" extensions.
* @param extensions the string to parse
* @return the list of extensions
* @throws IllegalArgumentException if the string cannot be parsed
*/
public static List<WebSocketExtension> parseExtensions(String extensions) {
if (extensions == null || !StringUtils.hasText(extensions)) {
return Collections.emptyList();
}
else {
List<WebSocketExtension> result = new ArrayList<WebSocketExtension>();
for(String token : extensions.split(",")) {
result.add(parseExtension(token));
}
return result;
}
}
private static WebSocketExtension parseExtension(String extension) {
Assert.doesNotContain(extension, ",", "Expected a single extension value: " + extension);
String[] parts = StringUtils.tokenizeToStringArray(extension, ";");
String name = parts[0].trim();
Map<String, String> parameters = null;
if (parts.length > 1) {
parameters = new LinkedHashMap<String, String>(parts.length - 1);
for (int i = 1; i < parts.length; i++) {
String parameter = parts[i];
int eqIndex = parameter.indexOf('=');
if (eqIndex != -1) {
String attribute = parameter.substring(0, eqIndex);
String value = parameter.substring(eqIndex + 1, parameter.length());
parameters.put(attribute, value);
}
}
}
return new WebSocketExtension(name, parameters);
}Source: spring-projects/spring-framework