Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

`XML.unescape` rejects the character references `XML.escape` produces for control characters

未关闭
  • 哪里不对？
#1,089 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
java
领域
api, backend

调研方向

Start by reading XML.escape and XMLTokener.unescapeEntity; the stack trace identifies XMLTokener.java as the failing entry point, and the report also names XML.toJSONObject as an affected path. Check the existing XML tests for escaping and parsing, then add coverage for round-tripping the listed control characters. Done means the escape/unescape pair agrees and XML.toJSONObject can read back the reported string value.

由索引模型根据 Issue 内容生成。

描述

This bug was found by an automated program we have running that writes tests with hegel (but I have personally reviewed it). More details at the bottom, but the short version is that I am not personally affected by this bug, and if that's not welcome then please feel free to disregard it.

Escaping a string that contains U+0001, a form feed, U+007F, U+0085, a lone surrogate or U+FFFF with XML.escape gives a numeric character reference that XML.unescape then refuses with "Invalid numeric character reference"; a tab in the same position comes back unchanged. The same pair of calls sits under XML.toString and XML.toJSONObject, so a JSONObject whose string value contains a form feed converts to XML that the library cannot read back:

import org.json.JSONObject;
import org.json.XML;

public class Main {
    public static void main(String[] args) {
        for (String s : new String[] {"a\tb", "a\u0001b", "a\fb", "a\u007fb", "a\u0085b", "a\ud83db", "a\uffffb"}) {
            String escaped = XML.escape(s);
            System.out.print("escape -> " + escaped.replace("\t", "\\t") + "   unescape -> ");
            try {
                System.out.println(XML.unescape(escaped).equals(s) ? "same string" : "different string");
            } catch (Exception e) {
                System.out.println(e);
            }
        }
        String xml = XML.toString(new JSONObject().put("msg", "page\fbreak"));
        System.out.println(xml);
        System.out.println(XML.toJSONObject(xml));
    }
}

Output:

escape -> a\tb   unescape -> same string
escape -> ab   unescape -> org.json.JSONException: Invalid numeric character reference: 
escape -> ab   unescape -> org.json.JSONException: Invalid numeric character reference: 
escape -> ab   unescape -> org.json.JSONException: Invalid numeric character reference: 
escape -> a…b   unescape -> org.json.JSONException: Invalid numeric character reference: …
escape -> a�b   unescape -> org.json.JSONException: Invalid numeric character reference: �
escape -> ab   unescape -> org.json.JSONException: Invalid numeric character reference: 
<msg>page&#xc;break</msg>
Exception in thread "main" org.json.JSONException: Invalid numeric character reference: &#xc;
	at org.json.XMLTokener.unescapeEntity(XMLTokener.java:171)
	at org.json.XMLTokener.nextEntity(XMLTokener.java:148)
	at org.json.XMLTokener.nextContent(XMLTokener.java:117)
	at org.json.XML.parse(XML.java:422)
	at org.json.XML.toJSONObject(XML.java:821)
	at org.json.XML.toJSONObject(XML.java:907)
	at org.json.XML.toJSONObject(XML.java:706)
	at Main.main(Main.java:17)

For every one of these characters XML.escape writes an &#x…; reference and XML.unescape (and so XML.toJSONObject) throws on it. Whether escape should stop producing these references or unescape should accept them, the two ends of the pair disagree, and XML.toJSONObject(XML.toString(o)) fails for any object with such a character in a string value.

Tested on org.json:json 20260814 and on current master (4f822e0).

As mentioned at the top, this was found by an automated program that writes property-based tests for various open source projects using hegel, and the report was reviewed by hand before filing. We've also potentially found (but not yet hand validated) 17 other bugs in json-java. You can see the tests at https://github.com/hegeldev/hegel-zoo/tree/main/targets/java/json-java. Let us know if you would like us to file the other bugs found and/or contribute the tests. NB the tests are currently LLM generated and probably not yet suitable for inclusion as is, but we're happy to help get them into a better state if you want them.

主要语言
Java
星标
4.7k
派生
2.6k
平均合并
4 天 11 小时
30 天内合并 PR
7

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

stleary/JSON-java 的其他 Issue

查看 stleary/JSON-java 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。