arib06 opened a new pull request, #3903: URL: https://github.com/apache/avro/pull/3903
## What is the purpose of the change `SpecificCompiler.escapeForJavadoc` embeds untrusted schema `doc` strings into generated Javadoc comments and neutralizes only a literal `*/`, `<` and `>`. javac decodes Unicode escapes before it strips comments (JLS 3.3), so a `doc` value carrying the backslash-u escapes for the comment terminator is emitted verbatim and decoded to `*/` in the generated source, ending the Javadoc early and turning the rest of the doc into code. A field-level doc lands right before the field declaration, so the injected text becomes a clean class member. The sibling `escapeForJavaString` (used for the `SCHEMA$` literal) already doubles backslashes, so that path is safe; the Javadoc path was the gap. This applies the same neutralization at the single escaping helper, before the existing `*/` replacement, so no eligible Unicode escape can form. Valid docs without backslashes are emitted unchanged. ## Verifying this change This change added tests and can be verified as follows: - Added `TestSpecificCompiler#docCannotBreakOutViaUnicodeEscape`, which compiles a record whose field doc contains a backslash-u escape for the comment terminator and asserts no eligible Unicode escape survives in any generated file. It fails on the pre-fix code and passes after. - Existing `docsAreEscaped_avro4053` and the tools golden-file codegen tests still pass (docs without backslashes are unaffected). ## Documentation - Does this pull request introduce a new feature? no -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
