Copilot commented on code in PR #3892:
URL: https://github.com/apache/avro/pull/3892#discussion_r3616224244
##########
lang/java/compiler/src/test/java/org/apache/avro/compiler/specific/TestSpecificCompiler.java:
##########
@@ -1031,6 +1031,31 @@ void docsAreEscaped_avro4053() {
}
}
+ @Test
+ void annotationCannotBreakOutViaStringLiteral() {
+ // A crafted javaAnnotation value tries to terminate the first annotation,
+ // inject arbitrary declarations plus a static initializer, then reopen a
+ // second valid annotation. It relies on a string literal spanning past its
+ // intended closing quote. Such values must be rejected, not emitted
verbatim.
+ String jsonSchema = "{\n" + " \"type\": \"record\",\n" + " \"name\":
\"Injected\",\n"
+ + " \"javaAnnotation\": [\n"
+ + " \"java.lang.SuppressWarnings(\\\"x\\\") static {
System.exit(1); } @java.lang.SuppressWarnings(\\\"y\\\")\",\n"
+ + " \"SuppressWarnings(\\\"unchecked\\\")\"\n" + " ],\n" + "
\"fields\": [\n"
+ + " {\"name\": \"value\", \"type\": \"string\"}\n" + " ]\n" + "}";
+ Collection<SpecificCompiler.OutputFile> outputs = new
SpecificCompiler(SchemaParser.parseSingle(jsonSchema))
+ .compile();
+ for (SpecificCompiler.OutputFile outputFile : outputs) {
+ // The payload is echoed (safely escaped) inside the SCHEMA$ string
constant,
+ // so we must distinguish that from a verbatim emission as code. Real
injected
+ // code would carry unescaped quotes; the schema literal escapes them as
\".
+ assertFalse(outputFile.contents.contains("SuppressWarnings(\"x\") static
{ System.exit(1); }"),
+ "Code injection present? " + outputFile.contents);
+ // The legitimate annotation in the same list must still be emitted.
+
assertTrue(outputFile.contents.contains("@SuppressWarnings(\"unchecked\")"),
+ "Valid annotation missing? " + outputFile.contents);
+ }
Review Comment:
The test asserts the valid annotation is present in *every* generated output
file. Today this schema likely produces a single output, but if the compiler
ever emits additional helper files for a record (or nested types), this
assertion can become a false negative even though the security behavior is
correct. Consider asserting the injection payload is absent from all outputs,
and that the valid annotation appears in at least one output (or explicitly
assert outputs.size()==1).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
