From 203d59b612064f2666a2680ab5d97864e5fc35c6 Mon Sep 17 00:00:00 2001 From: Nabiha Date: Sun, 20 Sep 2026 12:20:29 +0530 Subject: [PATCH] handle oversized hex in unicode brace-escapes as syntax error --- src/main/java/graphql/parser/UnicodeUtil.java | 8 ++++++- src/main/resources/i18n/Parsing.properties | 1 + src/main/resources/i18n/Parsing_de.properties | 1 + src/main/resources/i18n/Parsing_nl.properties | 1 + .../StringValueParsingUnicodeTest.groovy | 24 +++++++++++++++++++ 5 files changed, 34 insertions(+), 1 deletion(-) diff --git a/src/main/java/graphql/parser/UnicodeUtil.java b/src/main/java/graphql/parser/UnicodeUtil.java index d8fbff6308..e3edb7448a 100644 --- a/src/main/java/graphql/parser/UnicodeUtil.java +++ b/src/main/java/graphql/parser/UnicodeUtil.java @@ -50,9 +50,15 @@ public static int parseAndWriteUnicode(I18n i18n, StringWriter writer, String st i = continueIndex + 2; int trailingStartIndex = isBracedEscape(string, i) ? i + 2 : i + 1; int trailingEndIndexExclusive = getEndIndexExclusive(i18n, string, i, sourceLocation); - int trailingCodePoint = Integer.parseInt(string, trailingStartIndex, trailingEndIndexExclusive, 16); continueIndex = isBracedEscape(string, i) ? trailingEndIndexExclusive : trailingEndIndexExclusive - 1; + int trailingCodePoint; + try { + trailingCodePoint = Integer.parseInt(string, trailingStartIndex, trailingEndIndexExclusive, 16); + } catch (NumberFormatException e) { + throw new InvalidUnicodeSyntaxException(i18n, "InvalidUnicode.invalidHexString", sourceLocation, offendingToken(string, i, continueIndex)); + } + if (isTrailingSurrogateValue(trailingCodePoint)) { writeCodePoint(writer, codePoint); writeCodePoint(writer, trailingCodePoint); diff --git a/src/main/resources/i18n/Parsing.properties b/src/main/resources/i18n/Parsing.properties index 20301dd471..1d75365e4b 100644 --- a/src/main/resources/i18n/Parsing.properties +++ b/src/main/resources/i18n/Parsing.properties @@ -28,3 +28,4 @@ InvalidUnicode.trailingLeadingSurrogate=Invalid unicode encountered. Trailing su InvalidUnicode.leadingTrailingSurrogate=Invalid unicode encountered. Leading surrogate must be followed by a trailing surrogate. Offending token ''{0}'' at line {1} column {2} InvalidUnicode.invalidCodePoint=Invalid unicode encountered. Not a valid code point. Offending token ''{0}'' at line {1} column {2} InvalidUnicode.incorrectEscape=Invalid unicode encountered. Incorrectly formatted escape sequence. Offending token ''{0}'' at line {1} column {2} +InvalidUnicode.invalidHexString=Invalid unicode encountered. Not a valid hex digits string. Offending token ''{0}'' at line {1} column {2} diff --git a/src/main/resources/i18n/Parsing_de.properties b/src/main/resources/i18n/Parsing_de.properties index 41247c67f2..65cfc6c806 100644 --- a/src/main/resources/i18n/Parsing_de.properties +++ b/src/main/resources/i18n/Parsing_de.properties @@ -28,3 +28,4 @@ InvalidUnicode.trailingLeadingSurrogate=Ungültiger Unicode gefunden. Trailing s InvalidUnicode.leadingTrailingSurrogate=Ungültiger Unicode gefunden. Auf ein leading surrogate muss ein trailing surrogate folgen. Ungültiges Token ''{0}'' in Zeile {1} Spalte {2} InvalidUnicode.invalidCodePoint=Ungültiger Unicode gefunden. Kein gültiger code point. Ungültiges Token ''{0}'' in Zeile {1} Spalte {2} InvalidUnicode.incorrectEscape=Ungültiger Unicode gefunden. Falsch formatierte Escape-Sequenz. Ungültiges Token ''{0}'' in Zeile {1} Spalte {2} +InvalidUnicode.invalidHexString=Ungültiger Unicode gefunden. Keine gültige Hexadezimalzeichenfolge. Ungültiges Token ''{0}'' in Zeile {1} Spalte {2} diff --git a/src/main/resources/i18n/Parsing_nl.properties b/src/main/resources/i18n/Parsing_nl.properties index 770397d98d..91287f1e25 100644 --- a/src/main/resources/i18n/Parsing_nl.properties +++ b/src/main/resources/i18n/Parsing_nl.properties @@ -27,3 +27,4 @@ InvalidUnicode.trailingLeadingSurrogate=Ongeldige Unicode tegengekomen. Trailing InvalidUnicode.leadingTrailingSurrogate=Ongeldige Unicode tegengekomen. Leading surrogate moet voorafgaan aan een trailing surrogate. Ongeldige token ''{0}'' op lijn {1} kolom {2} InvalidUnicode.invalidCodePoint=Ongeldige Unicode tegengekomen. Ongeldig codepunt. Ongeldige token ''{0}'' op lijn {1} kolom {2} InvalidUnicode.incorrectEscape=Ongeldige Unicode tegengekomen. Ongeldige geformatteerde escape-sequentie. Ongeldige token ''{0}'' op lijn {1} kolom {2}} +InvalidUnicode.invalidHexString=Ongeldige Unicode tegengekomen. Geen geldige hexadecimale tekenreeks. Ongeldige token ''{0}'' op lijn {1} kolom {2} diff --git a/src/test/groovy/graphql/parser/StringValueParsingUnicodeTest.groovy b/src/test/groovy/graphql/parser/StringValueParsingUnicodeTest.groovy index 192f3b0097..19eef2c5bd 100644 --- a/src/test/groovy/graphql/parser/StringValueParsingUnicodeTest.groovy +++ b/src/test/groovy/graphql/parser/StringValueParsingUnicodeTest.groovy @@ -257,4 +257,28 @@ class StringValueParsingUnicodeTest extends Specification { InvalidSyntaxException e = thrown(InvalidSyntaxException) e.message == "Invalid unicode encountered. Not a valid code point. Offending token '\\u{fffffff}' at line -1 column -1" } + + def "invalid unicode code point - braced hex value overflows int"() { + given: + def input = '''"\\u{fffffffff}"''' + + when: + StringValueParsing.parseSingleQuotedString(i18n, input,sourceLocation) + + then: + InvalidSyntaxException e = thrown(InvalidSyntaxException) + e.message == "Invalid unicode encountered. Not a valid hex digits string. Offending token '\\u{fffffffff}' at line -1 column -1" + } + + def "invalid surrogate pair - trailing braced hex value overflows int"() { + given: + def input = '''"\\uD83D\\u{fffffffff}"''' + + when: + StringValueParsing.parseSingleQuotedString(i18n, input,sourceLocation) + + then: + InvalidSyntaxException e = thrown(InvalidSyntaxException) + e.message == "Invalid unicode encountered. Not a valid hex digits string. Offending token '\\u{fffffffff}' at line -1 column -1" + } }