Skip to content

reject non-ASCII hex characters in Conversion.hexDigitToInt - #1767

Open
alhudz wants to merge 1 commit into
apache:masterfrom
alhudz:conversion-hexdigit-ascii
Open

reject non-ASCII hex characters in Conversion.hexDigitToInt#1767
alhudz wants to merge 1 commit into
apache:masterfrom
alhudz:conversion-hexdigit-ascii

Conversation

@alhudz

@alhudz alhudz commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Repro: Conversion.hexToInt("aa", 0, 0, 0, 2) (two U+FF41 FULLWIDTH LATIN SMALL LETTER A) returns 170, the same value as the ASCII "aa", and Conversion.hexDigitToInt('٩') (U+0669 ARABIC-INDIC DIGIT NINE) returns 9. Both should throw.
Cause: hexDigitToInt reads the digit with Character.digit(hexChar, 16), which by its own specification recognises every Unicode decimal digit and the fullwidth Latin letters U+FF21-U+FF3A / U+FF41-U+FF5A, not only 0-9a-fA-F. The sibling converters hexDigitMsb0ToInt, hexDigitToBinary and hexDigitMsb0ToBinary switch over ASCII and do throw on the same chars, and CharUtils.isHex agrees with them. Since hexDigitToInt is the digit decoder behind hexToByte, hexToShort, hexToInt and hexToLong, the whole hex-string surface accepts homoglyphs, and strings that differ collapse onto one value.
Fix: screen the char with CharUtils.isHex before converting, reusing the message the siblings already use. Character.digit occurs once in the library, so this is the only site; ASCII input is unchanged.

  • Read the contribution guidelines for this project.
  • Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
  • I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
  • Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
  • Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant