Repository navigation
Reject duplicate MQTT 5 PUBLISH singleton properties - #2261
Merged
chkr1011 merged 1 commit intoSep 30, 2026
Merged
Conversation
chkr1011
approved these changes
Sep 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The MQTT 5 decoder accepts repeated singleton PUBLISH properties and overwrites the earlier value. Track presence within each PUBLISH packet and reject duplicates with MqttProtocolViolationException, including when the first value is zero or empty.
This covers Payload Format Indicator, Message Expiry Interval, Topic Alias, Response Topic, Correlation Data, and Content Type. MQTT 5.0 sections 3.3.2.3.2–3.3.2.3.6 and 3.3.2.3.9 explicitly classify these duplicates as Protocol Errors: https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html. Repeated User Properties and server-to-client Subscription Identifiers remain supported. MQTT 3 decoding and public APIs are unchanged.
Reproduction on master 18731d9: after a successful MQTT 5 CONNECT, sending QoS 1 PUBLISH bytes
32 0A 00 01 61 00 01 04 01 00 01 00yields PUBACK despite duplicate Payload Format Indicators. With this change the server closes the connection. The six synthetic decoder regression cases fail on unmodified master; the legal repeated-property control passes.Validation (Windows, Release):
dotnet build MQTTnet.slnx --no-restore --configuration Release: passed; three warnings in unchanged benchmark code.dotnet test --no-restore --framework net10.0 --configuration Release --project Source/MQTTnet.Tests/MQTTnet.Tests.csproj: all 493 tests passed.git diff --checkand whitespace verification of the changed decoder: passed.This PR is limited to PUBLISH singleton-property validation.