{"record":{"id":"f47f6fba5789ddff","repo":"theonedev/onedev","slug":"malformed-uxxxx-encoding","errorCode":null,"errorMessage":"Malformed \\uxxxx encoding.","messagePattern":"Malformed \\\\uxxxx encoding\\.","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/org/apache/wicket/util/string/Strings.java","lineNumber":522,"sourceCode":"\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tcase 'a' :\n\t\t\t\t\t\t\tcase 'b' :\n\t\t\t\t\t\t\tcase 'c' :\n\t\t\t\t\t\t\tcase 'd' :\n\t\t\t\t\t\t\tcase 'e' :\n\t\t\t\t\t\t\tcase 'f' :\n\t\t\t\t\t\t\t\tvalue = (value << 4) + 10 + aChar - 'a';\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tcase 'A' :\n\t\t\t\t\t\t\tcase 'B' :\n\t\t\t\t\t\t\tcase 'C' :\n\t\t\t\t\t\t\tcase 'D' :\n\t\t\t\t\t\t\tcase 'E' :\n\t\t\t\t\t\t\tcase 'F' :\n\t\t\t\t\t\t\t\tvalue = (value << 4) + 10 + aChar - 'A';\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\tdefault :\n\t\t\t\t\t\t\t\tthrow new IllegalArgumentException(\"Malformed \\\\uxxxx encoding.\");\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tout[outLen++] = (char)value;\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\tif (aChar == 't')\n\t\t\t\t\t{\n\t\t\t\t\t\taChar = '\\t';\n\t\t\t\t\t}\n\t\t\t\t\telse if (aChar == 'r')\n\t\t\t\t\t{\n\t\t\t\t\t\taChar = '\\r';\n\t\t\t\t\t}\n\t\t\t\t\telse if (aChar == 'n')\n\t\t\t\t\t{\n\t\t\t\t\t\taChar = '\\n';\n\t\t\t\t\t}","sourceCodeStart":504,"sourceCodeEnd":540,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/org/apache/wicket/util/string/Strings.java#L504-L540","documentation":"Strings.fromEscapedUnicode decodes \\uXXXX escape sequences (Java properties-file style) into a real string. When the four characters after \\u are not valid hex digits, the hex-parsing switch reaches its default branch and throws IllegalArgumentException('Malformed \\uxxxx encoding.'). This indicates the input string contains a \\u sequence that is not followed by exactly four hexadecimal characters.","triggerScenarios":"Calling Strings.fromEscapedUnicode(s) where s contains '\\u' followed by fewer than four chars or non-hex characters, e.g. '\\u12G4', '\\uabc', or a lone '\\u' at end of input.","commonSituations":"Hand-edited properties files with broken escapes; strings where a literal backslash-u appears (e.g. Windows paths like C:\\users) and are mistakenly treated as escapes; truncated data from copy/paste.","solutions":["Fix the source string so every \\u is followed by exactly four hex digits","Escape literal backslashes (\\\\u) when the backslash is not meant as an escape marker","Pre-validate the input with a regex like \\\\u[0-9a-fA-F]{4} before calling fromEscapedUnicode","Check for truncation if strings come from files or network payloads"],"exampleFix":"// before\nStrings.fromEscapedUnicode(\"C:\\\\users\\\\temp\"); // '\\use' parsed as escape -> throw\n// after\nStrings.fromEscapedUnicode(\"C:\\\\\\\\users\\\\\\\\temp\"); // literal backslashes preserved","handlingStrategy":"validation","validationCode":"// Java\nstatic boolean safeUnicodeInput(String s) {\n    return !s.matches(\".*[^\\\\]\\\\\\\\u(?!([0-9A-Fa-f]{4})).*\");\n}\n// or simpler: only call fromEscapedUnicode on strings known to be \\u-escaped properties","typeGuard":null,"tryCatchPattern":"try {\n    return Strings.fromEscapedUnicode(s);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Malformed \\\\u escape in input, returning raw\", e);\n    return s;\n}","preventionTips":["Validate with regex \\\\u[0-9A-Fa-f]{4} before decoding","Escape literal backslashes in Windows paths and non-escape contexts","Check data sources for truncation","Only apply the decoder to data you know used \\u escaping"],"tags":["wicket","string-parsing","unicode-escape"],"backgroundTag":"invalid-escape-sequence","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}