[PR] reject sign characters in UnicodeUnescaper hex digits [commons-text]

["dxbjavid (via GitHub)" <gi...@apache.org>]

dxbjavid opened a new pull request, #784:
URL: https://github.com/apache/commons-text/pull/784

   UnicodeUnescaper.translate, which backs StringEscapeUtils.unescapeJava, unescapeEcmaScript and unescapeJson, takes the four characters after `\u` (or `\u+`) and hands them to `Integer.parseInt(s, 16)` without checking that they are hex digits. parseInt accepts a leading sign, so `unescapeJava("\\u-03C")` returns U+FFC4 (the negative value cast to char) and `unescapeJava("\\u++03C")` returns `<`. Neither is a valid Java, JSON or ECMAScript escape, and the second means a text filter looking for the canonical `\u003C` form can be sidestepped by an input that this method still decodes to `<`.
   
   The fix rejects any non-hex character in the four-digit field with the same IllegalArgumentException the class already throws for other malformed values (for example `\u00G1`). Valid input, including the `\u+0047` and `\uuuu0047` forms, decodes exactly as before. UnicodeUnescaperTest#testSignNotHexDigit fails without the main change and passes with it, and the default `mvn` build is green (1990 tests).
   
   ---
   
   - [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
   - [x] Read the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) if you use Artificial Intelligence (AI).
   - [x] I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
     This fix was found and prepared with AI assistance (Claude) and reviewed by me before submitting. The AI located the defect, wrote the patch and test, and ran the build.
   - [x] Run a successful build using the default [Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command line by itself.
   - [x] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
   - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
   - [x] Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org