[
https://issues.apache.org/jira/browse/AVRO-4313?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099292#comment-18099292
]
ASF subversion and git services commented on AVRO-4313:
-------------------------------------------------------
Commit 7cd02f6fd5479c613fab7f80a4b4d2c61aba1ec3 in avro's branch
refs/heads/branch-1.12 from Ismaël Mejía
[ https://gitbox.apache.org/repos/asf?p=avro.git;h=7cd02f6fd5 ]
AVRO-4313: [java] Tighten javaAnnotation string-literal validation in
SpecificCompiler (#3892)
* AVRO-4313: [java] Tighten javaAnnotation string-literal validation in
SpecificCompiler
The string-literal grammar used to validate javaAnnotation values accepted
an unescaped quote inside the literal body, letting a single literal span
past its intended closing quote and absorb surrounding tokens. Constrain the
body to recognized escape sequences or characters that are not a quote,
backslash, or line terminator, and add a regression test.
* AVRO-4313: Exclude all line terminators from annotation string literals
Also reject NEL, LS and PS in addition to CR and LF so an annotation value
cannot span multiple lines in the generated source.
* AVRO-4313: Make injection regression test robust to multiple outputs
Assert the injection payload is absent from every generated file and the
valid annotation is emitted in at least one, rather than requiring it in
each output file.
> [java] Tighten javaAnnotation string-literal validation in SpecificCompiler
> ---------------------------------------------------------------------------
>
> Key: AVRO-4313
> URL: https://issues.apache.org/jira/browse/AVRO-4313
> Project: Apache Avro
> Issue Type: Bug
> Components: java
> Affects Versions: 1.11.5, 1.12.1
> Reporter: Ismaël Mejía
> Assignee: Ismaël Mejía
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.12.2
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> The {{javaAnnotation}} validator in {{SpecificCompiler}} uses a regular
> expression (\{{PATTERN_STRING}}) whose string-literal grammar accepts an
> unescaped quote inside the literal body. As a result a single string literal
> can extend past its intended closing quote and absorb arbitrary tokens, so a
> crafted {{javaAnnotation}} value can full-match the {{IDENTIFIER(STRING)}}
> shape while actually containing extra Java declarations. Because the record
> template emits annotation values verbatim, such a value would be written
> directly into the generated specific-record source.
> This tightens the string-literal grammar so the body may only contain
> recognized escape sequences or characters that are not a quote, backslash, or
> line terminator. Legitimate annotation values (for example
> {{{}SuppressWarnings("unchecked"){}}}, {{{}Deprecated(forRemoval = true,
> since = "forever"){}}}, and values with escaped quotes) continue to validate.
> A regression test is added.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
