Skip to content

[java] escape backslashes in escapeForJavadoc to stop comment breakout - #3903

Open
arib06 wants to merge 1 commit into
apache:mainfrom
arib06:javadoc-unicode-escape-breakout
Open

[java] escape backslashes in escapeForJavadoc to stop comment breakout#3903
arib06 wants to merge 1 commit into
apache:mainfrom
arib06:javadoc-unicode-escape-breakout

Conversation

@arib06

@arib06 arib06 commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

What is the purpose of the change

SpecificCompiler.escapeForJavadoc embeds untrusted schema doc strings into generated Javadoc comments and neutralizes only a literal */, < and >. javac decodes Unicode escapes before it strips comments (JLS 3.3), so a doc value carrying the backslash-u escapes for the comment terminator is emitted verbatim and decoded to */ in the generated source, ending the Javadoc early and turning the rest of the doc into code. A field-level doc lands right before the field declaration, so the injected text becomes a clean class member.

The sibling escapeForJavaString (used for the SCHEMA$ literal) already doubles backslashes, so that path is safe; the Javadoc path was the gap. This applies the same neutralization at the single escaping helper, before the existing */ replacement, so no eligible Unicode escape can form. Valid docs without backslashes are emitted unchanged.

Verifying this change

This change added tests and can be verified as follows:

  • Added TestSpecificCompiler#docCannotBreakOutViaUnicodeEscape, which compiles a record whose field doc contains a backslash-u escape for the comment terminator and asserts no eligible Unicode escape survives in any generated file. It fails on the pre-fix code and passes after.
  • Existing docsAreEscaped_avro4053 and the tools golden-file codegen tests still pass (docs without backslashes are unaffected).

Documentation

  • Does this pull request introduce a new feature? no

@github-actions github-actions Bot added the Java Pull Requests for Java binding label Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Java Pull Requests for Java binding

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant