emqx / emqx

The most scalable open-source MQTT broker for IoT, IIoT, and connected vehicles
https://www.emqx.com/
Other
14.09k stars 2.24k forks source link

Refuse usage of utf-8 control characters in topic names #14203

Closed gbrehmer closed 2 days ago

gbrehmer commented 2 days ago

What would you like to be added or enhanced?

Currently it is possible to use control characters in topic names. It should be possible to block such characters via configuration or block such characters in general. In MQTT 3.1.1 spec 1.5.3 it is stated like this (no MUST NOT but SHOULD NOT):

The data SHOULD NOT include encodings of the Unicode [[Unicode](http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html#Unicode)] code points listed below. If a receiver (Server or Client) receives a Control Packet containing any of them it MAY close the Network Connection:

U+0001..U+001F control characters 
U+007F..U+009F control characters 
Code points defined in the Unicode specification [[Unicode](http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html#Unicode)] to be non-characters (for example U+0FFFF)

Why is this needed?

In combination with paho mqtt java client lib this can cause bigger problems. In our case the control characters were accidentally used in retained messages. So everytime a backend client with a wildcard subscription will receive this faulty message topic and then stopped working. Reconnect is working yes, but in the mean time it will miss a lot of messages and faulty retained message is coming back after reconnection = same behavior in a loop. We also receive a 400 Bad request vom Dashboard API when we try to cleanup the faulty retained message,

gbrehmer commented 2 days ago

Ah probably "strict_mode" (https://docs.emqx.com/en/emqx/v5.8.1/hocon/#V-mqtt-S-mqtt-strict_mode) is the property i'm searching for. I have to check this

gbrehmer commented 2 days ago

This should work as required, I checked the code for strict mode handling:

https://github.com/emqx/emqx/blob/dac150cfe646d6a9058aa9ee387c09bb74389a04/apps/emqx/src/emqx_frame.erl#L1262-L1266