iemejia opened a new pull request, #3892:
URL: https://github.com/apache/avro/pull/3892
## What is the purpose of the change
The `javaAnnotation` validator in `SpecificCompiler` uses a regular
expression
(`PATTERN_STRING`) whose string-literal grammar accepts an unescaped quote
inside the literal body. As a result a single string literal can extend past
its intended closing quote and absorb surrounding tokens, so a crafted
`javaAnnotation` value can full-match the `IDENTIFIER(STRING)` shape while
actually carrying extra Java declarations. Because the record template emits
annotation values verbatim, such a value would be written directly into the
generated specific-record source.
This tightens the string-literal grammar so the body may only contain
recognized escape sequences or characters that are not a quote, backslash, or
line terminator. Legitimate annotation values (for example
`SuppressWarnings("unchecked")`, `Deprecated(forRemoval = true, since =
"forever")`,
and values with escaped quotes) continue to validate.
Fixes AVRO-4313.
## Verifying this change
This change added tests and can be verified as follows:
- Added `annotationCannotBreakOutViaStringLiteral` in `TestSpecificCompiler`,
which feeds a crafted `javaAnnotation` value and asserts it is not emitted
verbatim into the generated source, while a valid annotation in the same
list is still emitted. The test fails against the previous grammar and
passes with the tightened one.
- The existing `docsAreEscaped_avro4053` test and the full `compiler` module
test suite continue to pass.
## Documentation
- Does this pull request introduce a new feature? (no)
- If yes, how is the feature documented? (not applicable)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
