Fix input validation in XMLTokener.unescapeEntity()#1038
Fix input validation in XMLTokener.unescapeEntity()#1038stleary merged 3 commits intostleary:masterfrom
Conversation
Fix StringIndexOutOfBoundsException and NumberFormatException in XMLTokener.unescapeEntity() when parsing malformed XML numeric character references. Issues: - &#; (empty numeric reference) caused StringIndexOutOfBoundsException - &#txx; (invalid decimal) caused NumberFormatException - &#xGGG; (invalid hex) caused NumberFormatException Changes: - Add length validation before accessing character positions - Add isValidHex() and isValidDecimal() helper methods - Throw proper JSONException with descriptive messages Fixes stleary#1035, Fixes stleary#1036
|
Changes look good, but unescapeEntity() complexity is now too high: unescapeEntity() [stleary 1/28/2026] Issues fixed |
|
What problem does this code solve? Does the code still compile with Java6? Risks Changes to the API? Will this require a new release? Should the documentation be updated? Does it break the unit tests? Was any code refactored in this commit? Review status Starting 3-day comment window |
OwenSanzas
force-pushed
the
fix-xmltokener-unescapeentity
branch
from
2ec1d75 to
495474f
Compare
Extracted hex and decimal parsing logic into separate methods to address SonarQube complexity warning: - parseHexEntity(): handles ઼ format - parseDecimalEntity(): handles &stleary#123; format This reduces cyclomatic complexity while maintaining identical functionality and all validation checks.
OwenSanzas
force-pushed
the
fix-xmltokener-unescapeentity
branch
from
495474f to
6c1bfbc
Compare
Added comprehensive test coverage for numeric character reference parsing: Exception cases (should throw JSONException): - Empty numeric entity: &#; - Invalid decimal entity: &#txx; - Empty hex entity: &#x; - Invalid hex characters: &#xGGG; Valid cases (should parse correctly): - Decimal entity: &stleary#65; -> 'A' - Lowercase hex entity: A -> 'A' - Uppercase hex entity: A -> 'A' These tests verify the fixes for issues stleary#1035 and stleary#1036.
|
|
Hey @stleary, all requested changes are complete. Could you please take a look? After the refactoring:
|
2 participants
Fix StringIndexOutOfBoundsException and NumberFormatException in XMLTokener.unescapeEntity() when parsing malformed XML numeric character references.
Issues:
Changes:
Fixes #1035, Fixes #1036