fix: eventsource escapes as done in sockjs-node (#102)

The EventSource frame writer does no escaping of its messages.  This has caused a problem when updating from sockjs-client-0.3.4 to a more modern sockjs-1.5.x

Changes:
* eventsource escapes as done in sockjs-node
* unit test of eventSourceFrameWriter to confirm escaping

v3/sockjs/eventsource.go

@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
+	"strings"
 )
 
 func (h *Handler) eventSource(rw http.ResponseWriter, req *http.Request) {
@@ -34,6 +36,13 @@ func (h *Handler) eventSource(rw http.ResponseWriter, req *http.Request) {
 
 type eventSourceFrameWriter struct{}
 
+var escaper *strings.Replacer = strings.NewReplacer(
+	"%", url.QueryEscape("%"),
+	"\n", url.QueryEscape("\n"),
+	"\r", url.QueryEscape("\r"),
+	"\x00", url.QueryEscape("\x00"),
+)
+
 func (*eventSourceFrameWriter) write(w io.Writer, frame string) (int, error) {
-	return fmt.Fprintf(w, "data: %s\r\n\r\n", frame)
+	return fmt.Fprintf(w, "data: %s\r\n\r\n", escaper.Replace(frame))
 }

v3/sockjs/eventsource_test.go

@@ -1,6 +1,7 @@
 package sockjs
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"net/http/httptest"
@@ -91,3 +92,18 @@ func TestHandler_EventSourceConnectionInterrupted(t *testing.T) {
 		t.Errorf("session should be closed")
 	}
 }
+
+func TestEventSourceFrameWriter(t *testing.T) {
+	writer := new(eventSourceFrameWriter)
+	out := new(bytes.Buffer)
+
+	// Confirm that "important" characters are escaped, but others pass
+	// through unmodified.
+	_, err := writer.write(out, "escaped: %\r\n;unescaped: +&#")
+	if err != nil {
+		t.Errorf("unexpected write error: %s", err)
+	}
+	if out.String() != "data: escaped: %25%0D%0A;unescaped: +&#\r\n\r\n" {
+		t.Errorf("wrong, got '%v'", out.String())
+	}
+}