GROOVY-12233: StringEscapeUtils.unescapeJava mis-decodes and silently…

[paulk-asert]

… drops malformed \u escapes

[Copilot]

Pull request overview

Tightens groovy.json.StringEscapeUtils.unescapeJava Unicode-escape handling to match Java/JavaScript \uXXXX grammar and to fail fast (with JsonException) on malformed escapes instead of mis-decoding or silently dropping input.

Changes:

• Validate \u escapes as exactly four ASCII hex digits (rejects signs and non-ASCII digits that Integer.parseInt(..., 16) would otherwise accept).
• Reject truncated \u escapes at end-of-input (previously digits could be silently discarded).
• Expand test coverage for malformed and boundary-case Unicode escapes; align invalid-unicode exception type to JsonException.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
subprojects/groovy-json/src/main/java/groovy/json/StringEscapeUtils.java	Enforces strict \uXXXX parsing, throws JsonException on malformed/truncated escapes, adds isHexDigit helper and Javadoc @throws.
subprojects/groovy-json/src/test/groovy/groovy/json/StringEscapeUtilsTest.groovy	Adds regression tests for GROOVY-12233 and updates invalid-unicode expectation to JsonException.

Suppressed comments (1)

subprojects/groovy-json/src/main/java/groovy/json/StringEscapeUtils.java:387

• When the input ends mid-escape (e.g. "\u"), unicode may be empty, producing an error message with no escape content. Including the \\u prefix ensures the exception clearly points to a truncated Unicode escape.

        if (inUnicode) {
            // the string ended in the middle of an escape, so the digits read so far are not a
            // value; dropping them silently would lose input the caller never asked us to discard
            throw new JsonException("Unable to parse unicode value: " + unicode);
        }

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.9900%. Comparing base (3fd4b4b) to head (0862982).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@                Coverage Diff                 @@
##               master      #2763        +/-   ##
==================================================
+ Coverage     69.9875%   69.9900%   +0.0025%     
- Complexity      35518      35528        +10     
==================================================
  Files            1557       1557                
  Lines          131685     131686         +1     
  Branches        24172      24174         +2     
==================================================
+ Hits            92163      92167         +4     
  Misses          31189      31189                
+ Partials         8333       8330         -3     

Files with missing lines	Coverage Δ
...n/src/main/java/groovy/json/StringEscapeUtils.java	96.8992% <100.0000%> (+0.0242%)	⬆️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.