iemejia opened a new pull request, #3880:
URL: https://github.com/apache/avro/pull/3880
## What is the purpose of the change
The Java code generator (`avro-compiler` / `avro-maven-plugin`) writes schema
documentation strings into the Javadoc comments of generated Java sources.
The `escapeForJavadoc` helper escapes the comment terminator (`*/`) and HTML
metacharacters, but it leaves backslashes untouched.
The Java compiler translates Unicode escapes (`\uXXXX`) across the whole
source
file, including inside comments, before comments are recognized (JLS 3.3).
As a
result, a documentation string containing backslash sequences can be
reinterpreted by the compiler and change the generated source in unintended
ways.
This change updates `escapeForJavadoc` to also neutralize backslashes by
encoding them as the HTML entity `\`, so documentation content is always
emitted as inert text in the generated Javadoc. The string-literal path
(`escapeForJavaString`, used for the embedded schema) already doubles
backslashes and is unaffected.
Fixes AVRO-4311.
## Verifying this change
This change added tests and can be verified as follows:
- Added `TestSpecificCompiler#unicodeEscapesInDocsAreNeutralized`, which
checks
both the `escapeForJavadoc` helper and full code generation against several
escape forms (multiple `u`s, backslash-producing escapes, even-length
backslash runs, uppercase-hex decoys, and a literal `*/`), asserting that
no
backslash reaches the generated Javadoc comments.
- The existing escaping test (`docsAreEscaped_avro4053`) continues to pass.
- Full `avro-compiler` module test suite is green (`mvn -pl compiler test`)
and
Spotless formatting passes.
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
