dxbjavid opened a new pull request, #784:
URL: https://github.com/apache/commons-text/pull/784
UnicodeUnescaper.translate, which backs StringEscapeUtils.unescapeJava,
unescapeEcmaScript and unescapeJson, takes the four characters after `\u` (or
`\u+`) and hands them to `Integer.parseInt(s, 16)` without checking that they
are hex digits. parseInt accepts a leading sign, so `unescapeJava("\\u-03C")`
returns U+FFC4 (the negative value cast to char) and `unescapeJava("\\u++03C")`
returns `<`. Neither is a valid Java, JSON or ECMAScript escape, and the second
means a text filter looking for the canonical `\u003C` form can be sidestepped
by an input that this method still decodes to `<`.
The fix rejects any non-hex character in the four-digit field with the same
IllegalArgumentException the class already throws for other malformed values
(for example `\u00G1`). Valid input, including the `\u+0047` and `\uuuu0047`
forms, decodes exactly as before. UnicodeUnescaperTest#testSignNotHexDigit
fails without the main change and passes with it, and the default `mvn` build
is green (1990 tests).
---
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
- [x] Read the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) if you use
Artificial Intelligence (AI).
- [x] I used AI to create any part of, or all of, this pull request. Which
AI tool was used to create this pull request, and to what extent did it
contribute?
This fix was found and prepared with AI assistance (Claude) and reviewed
by me before submitting. The AI located the defect, wrote the patch and test,
and ran the build.
- [x] Run a successful build using the default
[Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command
line by itself.
- [x] Write unit tests that match behavioral changes, where the tests fail
if the changes to the runtime are not applied. This may not always be possible,
but it is a best practice.
- [x] Write a pull request description that is detailed enough to understand
what the pull request does, how, and why.
- [x] Each commit in the pull request should have a meaningful subject line
and body. Note that a maintainer may squash commits during the merge process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
