On Wed, 19 Aug 2026 17:12:02 GMT, Marcono1234 <[email protected]> wrote:
>> The extra backslash is actually the prepending escaping backslash, as this >> represents an (incorrect) escape sequence. E.g, `\a` is printed as `\\u0061` > > Regarding this thread here (and the original > https://github.com/openjdk/jdk/pull/32282#discussion_r3801921449); what was > the original concern with bad characters in the exception message? Security > (e.g. log injection) or usability / readability (e.g. malformed message being > confusing)? > > I am a bit concerned that from a usability perspective this new message can > be confusing. Using your example, if a user writes `\a` and the exception > message says `\\u0061`, this connection might not be immediately obvious > (especially if the user does not know the hex value or the code points by > heart). > > Though I do understand that including control characters as is could be a > problem. Maybe the message is fine though; after all it is an implementation > detail and can be changed later on if necessary. > > Side note: The `'%c' is not a hex digit` exception message is affected by > this as well, and should be changed for consistency too? > (The `INVALID_POSITION_IN_NUMBER` message is not affected because it seems to > be only used with well known characters, not arbitrary ones.) I think the original intention was to prevent the injection. > Side note: The '%c' is not a hex digit exception message is affected by this > as well, and should be changed for consistency too? Good catch. I will address it as well ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32282#discussion_r3815742450
