[KOTLIN-SPRING;KOTLIN-KTOR] - Fix issues similar to CVE-2026-22785#23960
Draft
Picazsoo wants to merge 4 commits into
Draft
[KOTLIN-SPRING;KOTLIN-KTOR] - Fix issues similar to CVE-2026-22785#23960Picazsoo wants to merge 4 commits into
Picazsoo wants to merge 4 commits into
Conversation
…erators (CVE-2026-22785) Any triple-quoted Kotlin string rendered from an untrusted OpenAPI value is a code-injection sink: a description or example containing """ closes the string, allowing attacker-controlled Kotlin declarations in the generated code. Add a new �scapeInNormalString mustache lambda to AbstractKotlinCodegen that escapes backslashes, dollar signs, double-quotes, and newlines, making values safe to embed in regular double-quoted Kotlin strings. Since AbstractKotlinCodegen is the parent of all Kotlin generators, the lambda is available everywhere. Fix all identified sinks: kotlin-spring (CVE-2026-22785): api.mustache, apiInterface.mustache: description = """{{{unescapedNotes}}}""" -> description = "{{#lambda.escapeInNormalString}}{{{unescapedNotes}}}{{/lambda.escapeInNormalString}}" kotlin-server / ktor, ktor2: libraries/ktor/_response.mustache, libraries/ktor2/_response.mustache: val exampleContentString = """{{&example}}""" -> val exampleContentString = "{{#lambda.escapeInNormalString}}{{&example}}{{/lambda.escapeInNormalString}}" Tests: - Add regression test tripleQuoteInjectionInDescriptionIsBlocked (CVE-2026-22785) - Add commentEndingInDescriptionIsSanitized (KDoc */ injection) - Update multiLineOperationDescription assertion for new escaped format - Add test fixtures cve-description-injection.yaml and issue20502-kotlin-string-escaping.yaml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… ktor2 Add tests that verify exampleContentString in _response.mustache is rendered as a normal double-quoted string (not triple-quoted), blocking triple-quote injection via response example values. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Picazsoo
changed the title
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
…or triple-quoted strings A Kotlin triple-quoted string still supports dollar-sign string interpolation (\). An untrusted OpenAPI example value containing \ would therefore be evaluated at runtime inside �xampleContentString. Add �scapeInTripleQuotedString lambda to AbstractKotlinCodegen that replaces every \$ with \, preventing interpolation without switching away from triple-quoted strings. Apply it to both ktor and ktor2 _response.mustache. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR checklist
Commit all changed files.
This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
These must match the expectations made by your contribution.
You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example
./bin/generate-samples.sh bin/configs/java*.IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
Summary by cubic
Prevents code injection in generated Kotlin by replacing triple-quoted descriptions in
kotlin-springand neutralizing interpolation inkotlin-server(ktor/ktor2) response examples, addressing the same class of issues as CVE-2026-22785. Adds shared Mustache lambdas to safely embed untrusted OpenAPI values in Kotlin strings.escapeInNormalString(escapes , $, ", newlines) andescapeInTripleQuotedString(escapes $) lambdas inAbstractKotlinCodegen.kotlin-spring: switched@Operation(description = "...")inapi.mustacheandapiInterface.mustacheto{{#lambda.escapeInNormalString}}...{{/lambda.escapeInNormalString}}.kotlin-serverktor/ktor2:_response.mustachenow wrapsexamplewith{{#lambda.escapeInTripleQuotedString}}...{{/lambda.escapeInTripleQuotedString}}inside the triple-quoted string.ktor/ktor2) and worst-case escaping; updated multi-line description assertions; regenerated samples.Written for commit 43cea0a. Summary will update on new commits.