Escape */ in block-comment doc generators to prevent code injection (Java, Kotlin)

[kagancapar]

Summary

PR #8820 fixed a doc comment injection vulnerability in the TypeScript generator where */ in a doc comment could close the /** ... */ JSDoc block and inject arbitrary top-level code. However, the same vulnerability exists in all other generators that use block comments for documentation: Java, Kotlin, and Kotlin KMP.

Attack chain

1. Attacker adds a field doc comment to a .fbs schema:

   table Monster {
     /// */ static { Runtime.getRuntime().exec("calc"); } /*
     name:string;
   }

2. Victim runs flatc --java (or --kotlin)
3. Generated source contains a static {} initializer inside the class body
4. The injected code auto-executes when the class is loaded

Proof of concept (Java output before fix)

public final class Monster extends Table {
  /**
   * */ static { Runtime.getRuntime().exec("calc"); } /*
   */
  public String name() { ... }

The */ on line 2 closes the Javadoc comment. The static { ... } block becomes real Java code inside the Monster class. The /* re-opens a block comment to absorb the remaining */. The static initializer executes automatically when Monster is loaded.

Fix

Escape */ to *\/ in doc comment lines when the generator uses block comments (/** ... */), consistent with the TypeScript fix in #8820. The escape is only applied when a block comment config is active (i.e., first_line != nullptr), so line-comment generators (///, #) are unaffected.

Files changed:

• code_generators.cpp — shared GenComment() utility (used by Java)
• idl_gen_kotlin.cpp — custom GenerateComment()
• idl_gen_kotlin_kmp.cpp — custom GenerateComment()

Not affected (use line comments): C++, C#, Go, Rust, Swift, PHP, Python

Related PRs

• Fix(ts): escape doc comment terminator in generated JSDoc #8820 — Fixed same bug for TypeScript only (merged)

[kagancapar]

Verified end-to-end on latest master (25.12.19):

Before fix — field doc comment in .fbs:

table Monster {
  /// */ static { System.out.println(INJECTED); } /*
  name:string;
}

flatc --java generates:

public final class Monster extends Table {
  /**
   * */ static { System.out.println(INJECTED); } /*
   */
  public String name() { ... }

The static {} block compiles and auto-executes on class load. Confirmed with javac + java — the injected code runs before main().

After fix — same input produces:

  /**
   * *\/ static { System.out.println(INJECTED); } /*
   */

*\/ stays inside the Javadoc block. No injection.

This is the same bug class as #8820 (TypeScript), which was merged. Java/Kotlin/Kotlin KMP were not covered by that fix.