Copilot commented on code in PR #3892:
URL: https://github.com/apache/avro/pull/3892#discussion_r3616170719
##########
lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java:
##########
@@ -1054,7 +1054,11 @@ public String[] javaAnnotations(JsonProperties props) {
private static final String PATTERN_IDENTIFIER_PART =
"\\p{javaJavaIdentifierStart}\\p{javaJavaIdentifierPart}*";
private static final String PATTERN_IDENTIFIER =
String.format("(?:%s(?:\\.%s)*)", PATTERN_IDENTIFIER_PART,
PATTERN_IDENTIFIER_PART);
- private static final String PATTERN_STRING =
"\"(?:\\\\[\\\\\"ntfb]|(?<!\\\\).)*\"";
+ // A string literal is a quote, a body of escape sequences or characters that
+ // are not a quote, backslash or line terminator, and a closing quote. The
body
+ // must not be able to contain an unescaped quote, otherwise a single literal
+ // could span past the intended closing quote and swallow surrounding tokens.
+ private static final String PATTERN_STRING =
"\"(?:\\\\[\\\\\"ntfb]|[^\"\\\\\\r\\n])*\"";
Review Comment:
PATTERN_STRING now forbids only \r and \n, but it still allows other Java
source line terminators (e.g., NEL \u0085, LS \u2028, PS \u2029). Those
characters are not permitted unescaped inside a Java string literal; allowing
them here can let an invalid (or potentially line-breaking) annotation value
pass validation and be emitted into generated source.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
