Skip to content

Keep StringSubstitutor from treating a value's trailing $ as an escape - #786

Open
alhudz wants to merge 1 commit into
apache:masterfrom
alhudz:stringsubstitutor-value-escape
Open

alhudz wants to merge 1 commit into
apache:masterfrom
alhudz:stringsubstitutor-value-escape

Conversation

@alhudz

@alhudz alhudz commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

StringSubstitutor takes the escape character from the end of a substituted value when another variable follows it directly in the template. Same issue as commons-lang StrSubstitutor, fixed in apache/commons-lang#1834.

Repro:

Map<String, String> m = Map.of("price", "5$", "x", "X", "a", "$", "b", "B");
StringSubstitutor s = new StringSubstitutor(m);
s.replace("${price}${x}"); // expected "5$X", actual "5${x}"
s.replace("${a}${b}");     // expected "$B",  actual "${b}"

After ${price} is replaced, substitute resumes scanning at the end of the inserted value, and the escape check (pos > offset && builder.charAt(pos - 1) == escapeCh) reaches back into that value. The value loses its trailing $ and ${x} is passed through unresolved.

Fix: only accept an escape character at or after the end of the last substitution, same as the commons-lang change. The class Javadoc gets the same note that was added there.

Tests are ported from commons-lang (testReplaceValueEndingWithEscape*: plain, custom delimiters, default value, empty value, variable name substitution, preserveEscapes, recursive). All 7 fail without the change and pass with it. Default mvn goal is green.

The deprecated org.apache.commons.text.StrSubstitutor has the same check (pos > offset && chars[pos - 1] == escape). I've left it alone here; happy to add it if you want it covered too.

  • Read the contribution guidelines for this project.
  • Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
  • I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute? Claude (Anthropic) ported the commons-lang fix and tests to this class and drafted this description.
  • Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
  • Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

After a variable is replaced, substitute resumes scanning at the end of
the inserted value, and the escape check looks at the char before the
next prefix bounded only by the scan offset. A value ending in the
escape char therefore escaped the variable that follows it in the
template: the value lost its last char and the next variable was left
unresolved, e.g. price=5$ makes "${price}${x}" return "5${x}" instead
of "5$X".

Only accept an escape char at or after the end of the last
substitution. Same change as commons-lang StrSubstitutor (#1834),
with its regression tests ported over.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant