fix: limit the size of an event read by EventStreamReader - #1604

Fixes #1597.

Summary

EventStreamReader read lines with BufferedReader.readLine() and appended data: and comment lines until a blank line, so a server could make a client buffer an unbounded line or event in memory.

• Lines are now read with a bounded reader that keeps the CRLF, LF and CR handling of readLine(). As before, a CR returns the line at once and a following LF is skipped on the next read, so a live stream doesn't block on a trailing CR.
• The characters of an event's lines, without line terminators, count toward a maximum event size: 1 Mi characters by default, set with setMaxEventSize(int). DEFAULT_MAX_EVENT_SIZE is public.
• When the limit is exceeded, readEvent() throws an IOException and closes the reader, rather than truncating the event. Later reads return null.

The limit counts all the lines of an event (field names included), not only the data and comment text, which keeps the check simple and strict.

Testing

New cases in EventStreamTestCase:

• an event exactly at the limit is accepted;
• an oversized line fails and stops the reader;
• an event that exceeds the limit across several lines fails;
• the setter rejects non-positive values;
• CR line endings return an event without reading past the available input.

EventStreamTestCase and EventStreamConnectorTestCase pass locally (15 tests). The full core suite was not run locally, because the machine was short of memory; CI runs it.

🤖 Generated with Claude Code