EventStreamReader should limit the size of an event #1597

Problem

EventStreamReader (org.restlet.representation) has no limit on the size of a line or an event. It reads lines with BufferedReader.readLine(), and appends data: and comment lines to StringBuilders until a blank line ends the event.

A server that sends a very long line, or many data: lines with no blank line, makes the client buffer the whole thing in memory. A slow or hostile server can exhaust the client's heap with a single event.

Why it matters

SSE clients usually consume streams from servers they don't control, such as MCP servers and GraphQL subscriptions over graphql-sse. The GraphQL extension (#1581, #1592) works around this today with a byte budget per event on the input stream, which is approximate (one 8 KiB read-ahead margin) and has to be repeated by every SSE client.

Proposed direction

• Add a maximum event size to EventStreamReader, counting the data and comment text of the pending event and the current line. For example, use a constructor argument or a setter, with a generous default (e.g. 1 MiB) or "unlimited" to keep current behavior.
• When the limit is exceeded, throw an IOException from readEvent() and stop reading, rather than truncating the event.
• Read lines with a bounded reader so that a single line can't grow past the limit before it is checked.

Related

• Add a GraphQL extension on graphql-java (org.restlet.ext.graphql) #1581: GraphQL extension, which would drop its workaround