A Unicode Escape Can Turn a Java Comment into Executable Code
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Emad Khair at octri.dev shows how text in an OpenAPI spec can change generated SDK code. In Java, a \u000a escape inside a // comment becomes a newline before comment parsing, so the following statement runs; he reproduced this on OpenJDK 21, though no independent source is cited. Similar cases include PHP's ?>, Ruby's #{} interpolation, Go backticks and Rust doc-test fences. His advice: use per-language emitters, preserve original values, and test output with real toolchains. Python 3.13 and rustdoc claims weren't verified.