fix(java,php): neutralize doc-comment delimiters instead of deleting them - #8017
Open
gavinbarron wants to merge 2 commits into
Open
fix(java,php): neutralize doc-comment delimiters instead of deleting them#8017gavinbarron wants to merge 2 commits into
gavinbarron wants to merge 2 commits into
Conversation
…them The Java and PHP doc-comment sanitizers deleted the `*/` terminator via Replace(*/, empty). Deleting a two-character sequence lets the surrounding characters re-form it (e.g. **// collapses to */), allowing a hostile schema description to break out of a generated doc comment and inject code into the generated client. The Java sanitizer additionally ran the delimiter strip before the non-ASCII strip, so *e/ (with a non-ASCII char between) re-formed */ after the non-ASCII char was removed. Replace delimiters instead of deleting (/* -> //*, */ -> * /) via a new shared NeutralizeBlockCommentDelimiters helper, matching TypeScriptConventionService, and run the Java neutralization after the non-ASCII strip. Adds regression tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c3d2eefa-5201-4d73-b430-3c0ce09651cd
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens Kiota’s Java and PHP doc-comment sanitization to prevent doc-comment breakout/code-injection from schema-derived documentation text by neutralizing (replace-based) block comment delimiters instead of deleting them, eliminating delimiter re-formation cases like **// → */.
Changes:
- Added a shared
StringExtensions.NeutralizeBlockCommentDelimiters()helper that replaces/*→//*and*/→* /(never deletes). - Updated Java and PHP
RemoveInvalidDescriptionCharactersto use delimiter neutralization (and in Java, to run neutralization after non-ASCII stripping to avoid re-forming*/). - Added/updated regression tests covering delimiter re-formation and ordering edge cases (
**//,**\/,*é/,/*,*/) and adjusted expectations accordingly.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Kiota.Builder.Tests/Writers/Php/PhpWriterTests.cs | Adds regression coverage for PHP description sanitization to ensure */ cannot remain or re-form. |
| tests/Kiota.Builder.Tests/Writers/Php/CodeMethodWriterTests.cs | Updates expected emitted PHP doc output to match replace-based neutralization (* / instead of deletion). |
| tests/Kiota.Builder.Tests/Writers/Java/JavaWriterTests.cs | Adds regression coverage for Java sanitization including the non-ASCII-strip ordering case. |
| tests/Kiota.Builder.Tests/Writers/Java/CodeMethodWriterTests.cs | Updates expected emitted Java doc output to match replace-based neutralization. |
| src/Kiota.Builder/Writers/Php/PhpConventionService.cs | Switches PHP description sanitization from delete-based to neutralize-based logic. |
| src/Kiota.Builder/Writers/Java/JavaConventionService.cs | Reorders/switches Java description sanitization to neutralize after non-ASCII stripping, preventing re-formation. |
| src/Kiota.Builder/Extensions/StringExtensions.cs | Introduces the shared NeutralizeBlockCommentDelimiters() helper used by generators. |
Code Coverage OverviewLanguages: C# C# / code-coverage/dotnetThe overall coverage in commit a71a879 in the Show a code coverage summary of the most covered files.
Updated |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes doc-comment breakout / code-injection in the Java and PHP generators. Both sanitizers deleted the
*/terminator, which is unsafe: deleting a two-character sequence lets the surrounding characters rejoin into a new delimiter (**//→*/). A hostile OpenAPIdescription/summary/externalDocsvalue could therefore close the generated doc comment and inject executable code into the generated client.This mirrors the already-fixed C# CVE-2026-59860 class and reuses the non-re-forming, replace-based approach already present in
TypeScriptConventionService(/*→//*,*/→* /).Reports addressed
Three internal reports map onto two underlying code sinks:
**//→*/) — reported twice; same root cause, same fix.*/strip ran before the non-ASCII strip, so*é/re-formed*/after the non-ASCII char was removed.A single Java change fixes both Java reports (reorders the passes and switches delete→replace).
Changes
StringExtensions.NeutralizeBlockCommentDelimiters()— replaces (never deletes)/*and*/.RemoveInvalidDescriptionCharacters:\\→/, then neutralize.RemoveInvalidDescriptionCharacters:\\→/→ non-ASCII strip → neutralize →CleanupXMLString()(neutralization now runs after the non-ASCII strip).**//,**\/,*é/,*/,/*asserting exact output and no residual*/.Validation
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com