This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/main by this push:
new ac65a807e5d wsdl2java: escape WSDL documentation in javadoc and
validate customized names (#3511)
ac65a807e5d is described below
commit ac65a807e5d30a3173fd5a9799765220144d607e
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Mon Sep 28 13:58:07 2026 +0100
wsdl2java: escape WSDL documentation in javadoc and validate customized
names (#3511)
---
.../cxf/tools/common/model/JavaInterface.java | 16 +++-
.../cxf/tools/common/model/JavaInterfaceTest.java | 20 ++++-
.../jaxws/customization/JAXWSBindingParser.java | 28 ++++++-
.../jaxws/customization/Messages.properties | 1 +
.../customization/JAXWSBindingParserTest.java | 89 ++++++++++++++++++++++
5 files changed, 148 insertions(+), 6 deletions(-)
diff --git
a/tools/common/src/main/java/org/apache/cxf/tools/common/model/JavaInterface.java
b/tools/common/src/main/java/org/apache/cxf/tools/common/model/JavaInterface.java
index ff34381e50b..e7efbf183e6 100644
---
a/tools/common/src/main/java/org/apache/cxf/tools/common/model/JavaInterface.java
+++
b/tools/common/src/main/java/org/apache/cxf/tools/common/model/JavaInterface.java
@@ -74,6 +74,7 @@ public class JavaInterface implements JavaAnnotatable {
}
}
if (pfx != null) {
+ s2 = escapeJavaDocContent(s2);
if (d2.length() > 0) {
d2.append('\n');
}
@@ -88,12 +89,25 @@ public class JavaInterface implements JavaAnnotatable {
}
d = d2.toString();
} catch (IOException ex) {
- //ignore, use the raw value
+ //ignore, use the escaped value
+ d = escapeJavaDocContent(d);
}
}
return d;
}
+ /**
+ * Make sure documentation text taken from a WSDL cannot terminate the
+ * enclosing comment block. Unicode escapes are neutralized as well since
+ * the compiler translates them before lexing.
+ */
+ static String escapeJavaDocContent(String s) {
+ if (s.indexOf("\\u") == -1 && s.indexOf("*/") == -1) {
+ return s;
+ }
+ return s.replace("\\u", "\u").replace("*/", "*/");
+ }
+
public void setWebServiceName(String wsn) {
this.webserviceName = wsn;
}
diff --git
a/tools/common/src/test/java/org/apache/cxf/tools/common/model/JavaInterfaceTest.java
b/tools/common/src/test/java/org/apache/cxf/tools/common/model/JavaInterfaceTest.java
index 3f3dd04b7a8..c4894ef9c97 100644
---
a/tools/common/src/test/java/org/apache/cxf/tools/common/model/JavaInterfaceTest.java
+++
b/tools/common/src/test/java/org/apache/cxf/tools/common/model/JavaInterfaceTest.java
@@ -22,6 +22,7 @@ package org.apache.cxf.tools.common.model;
import org.junit.Test;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
public class JavaInterfaceTest {
@Test
@@ -32,4 +33,21 @@ public class JavaInterfaceTest {
assertEquals("org.apache.cxf.tools.common.model",
intf.getPackageName());
assertEquals("JavaInterface", intf.getName());
}
-}
\ No newline at end of file
+
+ @Test
+ public void testFormatJavaDocCannotCloseComment() throws Exception {
+ String doc = "Some docs */ int PWNED = 1; /*\n more \\u002a/ text";
+ String formatted = JavaInterface.formatJavaDoc(doc, " ");
+ assertFalse(formatted.contains("*/"));
+ assertFalse(formatted.contains("\\u"));
+ assertEquals(" * Some docs */ int PWNED = 1; /*\n * more
\u002a/ text", formatted);
+ }
+
+ @Test
+ public void testFormatJavaDocUnchanged() throws Exception {
+ assertEquals(" * Some docs\n * a/b * c",
+ JavaInterface.formatJavaDoc("Some docs\na/b * c", " "));
+ assertEquals(" * C:\\temp matches \\d+",
+ JavaInterface.formatJavaDoc("C:\\temp matches \\d+", "
"));
+ }
+}
diff --git
a/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
b/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
index 1935b952dfa..556625d6481 100644
---
a/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
+++
b/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParser.java
@@ -22,6 +22,7 @@ package
org.apache.cxf.tools.wsdlto.frontend.jaxws.customization;
import java.util.Iterator;
import java.util.logging.Logger;
+import javax.lang.model.SourceVersion;
import javax.wsdl.WSDLException;
import javax.wsdl.extensions.ExtensionRegistry;
import javax.xml.XMLConstants;
@@ -119,7 +120,7 @@ public class JAXWSBindingParser {
}
}
- String name = childElement.getAttribute("name");
+ String name =
checkIdentifier(childElement.getAttribute("name"));
String elementNameString =
childElement.getAttribute("childElementName");
QName elementName = null;
if (!StringUtils.isEmpty(elementNameString)) {
@@ -136,7 +137,7 @@ public class JAXWSBindingParser {
jaxwsBinding.addJaxwsPara(jpara);
} else if (isJAXWSClass(child)) {
Element childElement = (Element)child;
- String clzName = childElement.getAttribute("name");
+ String clzName =
checkQualifiedName(childElement.getAttribute("name"));
String javadoc = "";
Node docChild = DOMUtils.getChild(child,
Node.ELEMENT_NODE);
@@ -160,7 +161,26 @@ public class JAXWSBindingParser {
private String getMethodName(Node node) {
Element ele = (Element)node;
- return ele.getAttribute("name");
+ return checkIdentifier(ele.getAttribute("name"));
+ }
+
+ /**
+ * Customized names end up verbatim in the generated source, so they
+ * must be valid Java identifiers.
+ */
+ private static String checkIdentifier(String name) {
+ if (!StringUtils.isEmpty(name)
+ && (!SourceVersion.isIdentifier(name) ||
SourceVersion.isKeyword(name))) {
+ throw new ToolException(new Message("INVALID_JAVA_NAME", LOG,
name));
+ }
+ return name;
+ }
+
+ private static String checkQualifiedName(String name) {
+ if (!StringUtils.isEmpty(name) && !SourceVersion.isName(name)) {
+ throw new ToolException(new Message("INVALID_JAVA_NAME", LOG,
name));
+ }
+ return name;
}
@@ -188,7 +208,7 @@ public class JAXWSBindingParser {
private String getPackageName(Node node) {
Element ele = (Element)node;
- return ele.getAttribute("name");
+ return checkQualifiedName(ele.getAttribute("name"));
}
private Boolean isAsyncElement(Node node) {
diff --git
a/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/Messages.properties
b/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/Messages.properties
index d9889f15f8d..8e1c36083f3 100644
---
a/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/Messages.properties
+++
b/tools/wsdlto/frontend/jaxws/src/main/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/Messages.properties
@@ -35,3 +35,4 @@ MISSING_WSDL = Unable to read {0}.
OLD_JAXWS_NAMESPACE = Old JAXWS binding file namespace
\"https://java.sun.com/xml/ns/jaxws\"; is used.This binding file will be
ignored. Please use \"https://jakarta.ee/xml/ns/jaxws\"; instead
OLD_JAXB_NAMESPACE = Old JAXB binding file namespace
\"https://java.sun.com/xml/ns/jaxb\"; is used.This binding file will be ignored.
Please use \"https://jakarta.ee/xml/ns/jaxb\"; instead
INVALID_BINDING_FILE = Not a valid jaxb or jaxws binding file, please check
the namespace
+INVALID_JAVA_NAME = Customized name \"{0}\" is not a valid Java name.
diff --git
a/tools/wsdlto/frontend/jaxws/src/test/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParserTest.java
b/tools/wsdlto/frontend/jaxws/src/test/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParserTest.java
new file mode 100644
index 00000000000..c3acd2f3d3f
--- /dev/null
+++
b/tools/wsdlto/frontend/jaxws/src/test/java/org/apache/cxf/tools/wsdlto/frontend/jaxws/customization/JAXWSBindingParserTest.java
@@ -0,0 +1,89 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.tools.wsdlto.frontend.jaxws.customization;
+
+import java.io.StringReader;
+
+import org.w3c.dom.Element;
+
+import org.apache.cxf.staxutils.StaxUtils;
+import org.apache.cxf.tools.common.ToolConstants;
+import org.apache.cxf.tools.common.ToolException;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+public class JAXWSBindingParserTest {
+
+ private static JAXWSBinding parse(String body) throws Exception {
+ String xml = "<jaxws:bindings xmlns:jaxws=\"" +
ToolConstants.NS_JAXWS_BINDINGS + "\">"
+ + "<part name=\"p\"/>" + body + "</jaxws:bindings>";
+ Element el = StaxUtils.read(new
StringReader(xml)).getDocumentElement();
+ JAXWSBinding binding = new JAXWSBinding();
+ new JAXWSBindingParser(null).parseElement(binding, el);
+ return binding;
+ }
+
+ private static void assertRejected(String body) throws Exception {
+ try {
+ parse(body);
+ fail("Expected ToolException for " + body);
+ } catch (ToolException ex) {
+ assertTrue(ex.getMessage(), ex.getMessage().contains("not a valid
Java name"));
+ }
+ }
+
+ @Test
+ public void testValidNames() throws Exception {
+ JAXWSBinding binding = parse("<jaxws:package name=\"org.mypkg\"/>"
+ + "<jaxws:method name=\"myGreetMe\"/>"
+ + "<jaxws:class name=\"org.mypkg.MyGreeter\"/>"
+ + "<jaxws:parameter part=\"part\" name=\"num1\"/>");
+ assertEquals("org.mypkg", binding.getPackage());
+ assertEquals("myGreetMe", binding.getMethodName());
+ assertEquals("org.mypkg.MyGreeter",
binding.getJaxwsClass().getClassName());
+ assertEquals("num1", binding.getJaxwsParas().get(0).getName());
+ }
+
+ @Test
+ public void testInvalidMethodName() throws Exception {
+ assertRejected("<jaxws:method name=\"x(){} public void pwn(){} void
y\"/>");
+ assertRejected("<jaxws:method name=\"class\"/>");
+ assertRejected("<jaxws:method name=\"a.b\"/>");
+ }
+
+ @Test
+ public void testInvalidClassName() throws Exception {
+ assertRejected("<jaxws:class name=\"Foo { static { System.exit(1); } }
class Bar\"/>");
+ }
+
+ @Test
+ public void testInvalidPackageName() throws Exception {
+ assertRejected("<jaxws:package name=\"com.foo; import evil.*\"/>");
+ }
+
+ @Test
+ public void testInvalidParameterName() throws Exception {
+ assertRejected("<jaxws:parameter part=\"part\" name=\"a, int b\"/>");
+ }
+}
