Fix MQTT 5.0 WebSocket Session Resume Subinfo Handling Bug in EMQX

Based on the webpage screenshot provided by the user, I extracted the following key information: 1. Vulnerability Overview: Title: Fix MQTT session resume bug of subinfo in WebSocket transport #11405 Core Issue: This is a fix for a bug in MQTT protocol implementation where (subscription information) was incorrectly handled during session resume in WebSocket transport mode. Specific Behavior: In MQTT 5.0 protocol, when a client reconnects and requests to resume a session, the server needs to properly restore previous subscription information. The previous implementation contained a bug that prevented subscription information from being correctly restored or processed. Related Issue: Linked to issue #11405. 2. Impact Scope: Component: (subscription information structure). Protocol: MQTT 5.0 (specifically involving and scenarios). Transport Layer: WebSocket transport. Specific Scenario: When a client disconnects and reconnects, and the server retains the session (Clean Session = false), the server attempts to restore subscription information. 3. Fix Solution: Code Changes: Modified the definition of the structure and related processing logic. Specific Modifications: Added a field ( ) to the structure to store subscription properties. Modified the method of to ensure is also correctly copied. Modified the method of to ensure is correctly encoded when sending packets. Modified the method of to ensure is correctly decoded when receiving packets. Modified the logic of the function in the module to ensure that of can be correctly read and written during session resume. Testing: Added relevant unit tests ( ) to verify the fix. 4. POC/Exploit Code: The page displays fix code (diff), not exploit code. Extracted key parts of the fix code. Summary: This is a bug fix for MQTT 5.0 protocol implementation, primarily addressing the issue of subscription information ( ) being lost or corrupted during session resume in WebSocket transport mode. The fix involves extending the structure (adding properties field) and updating related encoding/decoding/clone logic. Extracted Code: The page displays a Go language code diff. (Note: The above code is reconstructed based on the diff content in the screenshot. The actual code in the screenshot may be more complex, containing specific variable names and logic details. The code in the screenshot mainly focuses on modifications to the structure.) Final Output Structure: Vulnerability Overview: Brief description of the MQTT 5.0 WebSocket session resume bug. Impact Scope: Identify affected components and scenarios. Fix Solution: Describe code-level modifications. Code Block: Extract key code diff from the screenshot. Vulnerability Summary Vulnerability Overview This page presents a fix for a Session Resume bug in MQTT 5.0 protocol under WebSocket transport mode. Specifically, the (subscription information) contained logic errors when handling session resume, causing subscription properties to fail to be correctly saved or restored. Impact Scope Protocol Version: MQTT 5.0 Transport Layer: WebSocket Transport Affected Components: structure and its related encoding/decoding/clone logic. Scenario: When a client disconnects and reconnects (Clean Session = false) to resume a session, the server cannot correctly restore previous subscription information and its properties. Fix Solution Structure Extension: Added a field (type ) to the structure to store subscription properties. Logic Updates: Updated the method to ensure is correctly deep-copied. Updated the and methods to ensure is correctly handled during serialization/deserialization of subscription information. Added logic for reading and writing in the function of the module, ensuring subscription properties can be correctly loaded during session resume. Test Verification: Added relevant unit test cases to verify the fixed functionality. Key Code Changes (POC/Fix Code)

Goal Reached Thanks to every supporter — we hit 100%!

Fix MQTT 5.0 WebSocket Session Resume Subinfo Handling Bug in EMQX

More from this source