theonedev/onedev · error · java.lang.IllegalArgumentException

Malformed \uxxxx encoding.

Error message

Malformed \uxxxx encoding.

What it means

Strings.fromEscapedUnicode decodes \uXXXX escape sequences (Java properties-file style) into a real string. When the four characters after \u are not valid hex digits, the hex-parsing switch reaches its default branch and throws IllegalArgumentException('Malformed \uxxxx encoding.'). This indicates the input string contains a \u sequence that is not followed by exactly four hexadecimal characters.

Source

Thrown at server-core/src/main/java/org/apache/wicket/util/string/Strings.java:522

								break;
							case 'a' :
							case 'b' :
							case 'c' :
							case 'd' :
							case 'e' :
							case 'f' :
								value = (value << 4) + 10 + aChar - 'a';
								break;
							case 'A' :
							case 'B' :
							case 'C' :
							case 'D' :
							case 'E' :
							case 'F' :
								value = (value << 4) + 10 + aChar - 'A';
								break;
							default :
								throw new IllegalArgumentException("Malformed \\uxxxx encoding.");
						}
					}
					out[outLen++] = (char)value;
				}
				else
				{
					if (aChar == 't')
					{
						aChar = '\t';
					}
					else if (aChar == 'r')
					{
						aChar = '\r';
					}
					else if (aChar == 'n')
					{
						aChar = '\n';
					}

View on GitHub (pinned to d44925c47c)

Solutions

1. Fix the source string so every \u is followed by exactly four hex digits
2. Escape literal backslashes (\\u) when the backslash is not meant as an escape marker
3. Pre-validate the input with a regex like \\u[0-9a-fA-F]{4} before calling fromEscapedUnicode
4. Check for truncation if strings come from files or network payloads

Example fix

// before
Strings.fromEscapedUnicode("C:\\users\\temp"); // '\use' parsed as escape -> throw
// after
Strings.fromEscapedUnicode("C:\\\\users\\\\temp"); // literal backslashes preserved

// Java
static boolean safeUnicodeInput(String s) {
    return !s.matches(".*[^\\]\\\\u(?!([0-9A-Fa-f]{4})).*");
}
// or simpler: only call fromEscapedUnicode on strings known to be \u-escaped properties

try {
    return Strings.fromEscapedUnicode(s);
} catch (IllegalArgumentException e) {
    log.warn("Malformed \\u escape in input, returning raw", e);
    return s;
}

When it happens

Trigger: Calling Strings.fromEscapedUnicode(s) where s contains '\u' followed by fewer than four chars or non-hex characters, e.g. '\u12G4', '\uabc', or a lone '\u' at end of input.

Common situations: Hand-edited properties files with broken escapes; strings where a literal backslash-u appears (e.g. Windows paths like C:\users) and are mistakenly treated as escapes; truncated data from copy/paste.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Page classes should extend from BasePage.
• Base resource mapper should be used
• Invalid date range, expecting "yyyy-MM-dd to yyyy-MM-dd"
• Path '${mountPath}' should be mounted to a svg sprite resour
• Unable to find svg sprite resource mounted at: ${mountPath}

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/f47f6fba5789ddff. Report an issue: GitHub.