Re: [PR] AVRO-4313: [java] Tighten javaAnnotation string-literal validation in SpecificCompiler [avro]

["Copilot (via GitHub)" <gi...@apache.org>]

Copilot commented on code in PR #3892:
URL: https://github.com/apache/avro/pull/3892#discussion_r3616170719


##########
lang/java/compiler/src/main/java/org/apache/avro/compiler/specific/SpecificCompiler.java:
##########
@@ -1054,7 +1054,11 @@ public String[] javaAnnotations(JsonProperties props) {
   private static final String PATTERN_IDENTIFIER_PART = "\\p{javaJavaIdentifierStart}\\p{javaJavaIdentifierPart}*";
   private static final String PATTERN_IDENTIFIER = String.format("(?:%s(?:\\.%s)*)", PATTERN_IDENTIFIER_PART,
       PATTERN_IDENTIFIER_PART);
-  private static final String PATTERN_STRING = "\"(?:\\\\[\\\\\"ntfb]|(?<!\\\\).)*\"";
+  // A string literal is a quote, a body of escape sequences or characters that
+  // are not a quote, backslash or line terminator, and a closing quote. The body
+  // must not be able to contain an unescaped quote, otherwise a single literal
+  // could span past the intended closing quote and swallow surrounding tokens.
+  private static final String PATTERN_STRING = "\"(?:\\\\[\\\\\"ntfb]|[^\"\\\\\\r\\n])*\"";

Review Comment:
   PATTERN_STRING now forbids only \r and \n, but it still allows other Java source line terminators (e.g., NEL \u0085, LS \u2028, PS \u2029). Those characters are not permitted unescaped inside a Java string literal; allowing them here can let an invalid (or potentially line-breaking) annotation value pass validation and be emitted into generated source.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@avro.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org