(commons-lang) branch master updated: Escape CharSequence values in ToStringStyle.JSON_STYLE (#1821)

[gg...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-lang.git


The following commit(s) were added to refs/heads/master by this push:
     new 1c1a79822 Escape CharSequence values in ToStringStyle.JSON_STYLE (#1821)
1c1a79822 is described below

commit 1c1a7982206c915d3470e89af2366e34c1b21d23
Author: alhuda <50...@users.noreply.github.com>
AuthorDate: Fri Oct 16 04:49:47 2026 +0530

    Escape CharSequence values in ToStringStyle.JSON_STYLE (#1821)
    
    JsonToStringStyle.appendDetail(StringBuffer, String, Object) quotes and
    escapes only String and Character values. Any other value whose
    toString() is wrapped in {} or [] is appended raw, which is meant for
    nested objects that already render as JSON. A StringBuilder or other
    non-String CharSequence holding brace-wrapped text therefore went out
    unescaped and could inject keys into the output. Treat every
    CharSequence as a string value.
---
 .../java/org/apache/commons/lang3/builder/ToStringStyle.java   |  2 +-
 .../apache/commons/lang3/builder/JsonToStringStyleTest.java    | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/apache/commons/lang3/builder/ToStringStyle.java b/src/main/java/org/apache/commons/lang3/builder/ToStringStyle.java
index 50f5723c2..b2729381b 100644
--- a/src/main/java/org/apache/commons/lang3/builder/ToStringStyle.java
+++ b/src/main/java/org/apache/commons/lang3/builder/ToStringStyle.java
@@ -256,7 +256,7 @@ protected void appendDetail(final StringBuffer buffer, final String fieldName, f
                 appendNullText(buffer, fieldName);
                 return;
             }
-            if (value instanceof String || value instanceof Character) {
+            if (value instanceof CharSequence || value instanceof Character) {
                 appendValueAsString(buffer, value.toString());
                 return;
             }
diff --git a/src/test/java/org/apache/commons/lang3/builder/JsonToStringStyleTest.java b/src/test/java/org/apache/commons/lang3/builder/JsonToStringStyleTest.java
index 3925cdd63..702fdbf94 100644
--- a/src/test/java/org/apache/commons/lang3/builder/JsonToStringStyleTest.java
+++ b/src/test/java/org/apache/commons/lang3/builder/JsonToStringStyleTest.java
@@ -265,6 +265,16 @@ void testCharArray() {
         assertThrows(UnsupportedOperationException.class, () -> toStringBuilder.append((Object) array).toString());
     }
 
+    @Test
+    void testCharSequenceIsEscaped() {
+        final String text = "{},\"admin\":true,\"x\":{}";
+        final String expected = "{\"name\":\"{},\\\"admin\\\":true,\\\"x\\\":{}\"}";
+        assertEquals(expected, new ToStringBuilder(base).append("name", text).toString());
+        assertEquals(expected, new ToStringBuilder(base).append("name", new StringBuilder(text)).toString());
+        assertEquals(expected, new ToStringBuilder(base).append("name", new StringBuffer(text)).toString());
+        assertEquals("{\"name\":[\"[1]\"]}", new ToStringBuilder(base).append("name", Arrays.asList(new StringBuilder("[1]"))).toString());
+    }
+
     @Test
     void testCombineListAndEnum() {
         final Teacher teacher = new Teacher();