[
https://issues.apache.org/jira/browse/AVRO-4311?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101445#comment-18101445
]
ASF subversion and git services commented on AVRO-4311:
-------------------------------------------------------
Commit cd998891e595bf8b2444f538e84d9fd7a0336a3f in avro's branch
refs/heads/dependabot/uv/lang/py/setuptools-83.0.0 from Ismaël Mejía
[ https://gitbox.apache.org/repos/asf?p=avro.git;h=cd998891e5 ]
AVRO-4311: [java] Escape backslashes in generated Javadoc (#3880)
* AVRO-4311: [java] Escape backslashes in generated Javadoc
The code generator writes schema documentation strings into the
Javadoc comments of generated Java sources. escapeForJavadoc escaped
the comment terminator and HTML metacharacters but left backslashes
untouched.
The Java compiler translates Unicode escapes (\uXXXX) across the whole
source file, including inside comments, before comments are recognized
(JLS 3.3). A documentation string containing backslash sequences could
therefore be reinterpreted by the compiler and change the generated
source in unintended ways.
Neutralize backslashes in escapeForJavadoc by encoding them as the
HTML entity \, so documentation content is always emitted as inert
text. Add a regression test covering several escape forms. The
string-literal path (escapeForJavaString) already doubles backslashes
and is unaffected.
* AVRO-4311: [java] Strengthen Javadoc escaping regression test
Address review feedback: the end-to-end assertion only inspected lines
starting with "/**" or "*", so the middle physical lines of a
multi-line Javadoc block (a doc containing newlines) were not checked.
Replace the line-based scan with one that removes all Java string
literals (the embedded schema, which legitimately contains doubled
backslashes) and then asserts no backslash remains in the surrounding
code and comments. Add a doc vector that spans multiple physical lines.
> [java] Neutralize backslashes when escaping schema docs into generated Javadoc
> ------------------------------------------------------------------------------
>
> Key: AVRO-4311
> URL: https://issues.apache.org/jira/browse/AVRO-4311
> Project: Apache Avro
> Issue Type: Bug
> Components: java
> Affects Versions: 1.11.5, 1.12.1
> Reporter: Ismaël Mejía
> Assignee: Ismaël Mejía
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.13.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The Java code generator (avro-compiler / avro-maven-plugin) writes schema
> documentation strings into the Javadoc comments of generated Java sources.
> The `escapeForJavadoc` helper escapes the comment terminator (`*/`) and HTML
> metacharacters, but it does not neutralize backslashes.
> The Java compiler translates Unicode escapes (`\uXXXX`) across the whole
> source file, including inside comments, before comments are recognized (JLS
> 3.3). As a result, a documentation string that contains backslash sequences
> can be reinterpreted by the compiler and change the generated source in
> unintended ways.
> Fix: update `escapeForJavadoc` to also neutralize backslashes by encoding
> them as the HTML entity `\`, so documentation content is always emitted
> as inert text in the generated Javadoc. A regression test covering several
> escape forms is added.
> The string-literal path (`escapeForJavaString`, used for the embedded schema)
> already doubles backslashes and is unaffected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
