Uploaded image for project: 'ActiveMQ Classic'
  1. ActiveMQ Classic
  2. AMQ-2817

STOMP headers need sanitization

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Minor
    • Resolution: Fixed
    • 5.3.2
    • 5.4.0
    • Transport
    • None
    • Patch Available

    Description

      Currently STOMP on a SEND extracts out the JMS headers and put the rest of the headers into the message properties. If a STOMP consumer starts to consume the messages, the JMS fields are put into the header and the the properties are put in. This can lead to a situation where if the client has provided a header that it shouldn't have (e.g. message-id) it overwrites the one provided by the broker.

      This can lead to problems with e.g. ACKs where the wrong message-id is sent back.

      This patch sanitizes all headers for a MESSAGE frame when they come into the broker so they never get set in the properties.

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            dejanb Dejan Bosanac
            jamesc James C
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment