SseUtil unexpectedly stores headers in Serialisers.EMPTY_MULTI_MAP

[cardil]

Describe the bug

The SseUtil class is using Serialisers.EMPTY_MULTI_MAP variable, here:

quarkus/independent-projects/resteasy-reactive/server/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/SseUtil.java

Lines 140 to 141 in ca20858

	writer.writeTo(entity, entityClass, entityType, Serialisers.NO_ANNOTATION, mediaType,
	Serialisers.EMPTY_MULTI_MAP, baos);

This leads to storing of subsequent headers in this map Serialisers.EMPTY_MULTI_MAP. This leads to uncapped memory consumption, use of the whole available heap (possible DDoS). Also, invocations have access to previously set headers, which is a privacy concern.

Expected behavior

Sending with SseUtil should be safe and not lead to data leaks or DDoS.

Actual behavior

Sending with SseUtil will lead to data leaks or DDoS.

How to Reproduce?

@GET
@RestStreamElementType(MediaType.APPLICATION_JSON)
Multi<CloudEvent> events() {
  return Multi.createFrom().iterable(events);
}

See also: cardil/openshift-knative-showcase@15e0042

Output of uname -a or ver

Linux thinkpad-t590 6.1.13-200.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Feb 22 17:53:57 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Output of java -version

openjdk version "17.0.5" 2022-10-18
OpenJDK Runtime Environment Temurin-17.0.5+8 (build 17.0.5+8)
OpenJDK 64-Bit Server VM Temurin-17.0.5+8 (build 17.0.5+8, mixed mode, sharing)

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.13.5.Final-redhat-00002

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.8.7 (b89d5959fcde851dcb1c8946a785a163f14e1e29)

Additional information

/area resteasy-reactive

[quarkus-bot]

/cc @FroMage (resteasy-reactive), @Sgitario (resteasy-reactive), @stuartwdouglas (resteasy-reactive)

[cardil]

I think the following should fix this issue:

MultivaluedHashMap<String, Object> empty = new MultivaluedHashMap<>(Serialisers.EMPTY_MULTI_MAP);
writer.writeTo(entity, entityClass, entityType, Serialisers.NO_ANNOTATION, mediaType, 
         empty, baos); 

[geoand]

I can't reproduce this, but clearly the code is wrong. #31560 fixes the issue

[cardil]

You need to have a writer that writes headers. Try cloud events library.

[geoand]

Right, I Imagined as much as explained in the description of the PR