游.程 2015-06-09 09:02 采纳率: 0%
浏览 281
已采纳

为什么允许在注释中使用某些 Unicode 字符来执行 Java 代码?

The following code produces the output "Hello World!" (no really, try it).

public static void main(String... args) {

   // The comment below is not a typo.
   // \u000d System.out.println("Hello World!");
}

The reason for this is that the Java compiler parses the Unicode character \u000d as a new line and gets transformed into:

public static void main(String... args) {

   // The comment below is not a typo.
   //
   System.out.println("Hello World!");
}

Thus resulting into a comment being "executed".

Since this can be used to "hide" malicious code or whatever an evil programmer can conceive, why is it allowed in comments?

Why is this allowed by the Java specification?

转载于:https://stackoverflow.com/questions/30727515/why-is-executing-java-code-in-comments-with-certain-unicode-characters-allowed

  • 写回答

8条回答 默认 最新

  • ℡Wang Yan 2015-06-09 09:13
    关注

    Unicode decoding takes place before any other lexical translation. The key benefit of this is that it makes it trivial to go back and forth between ASCII and any other encoding. You don't even need to figure out where comments begin and end!

    As stated in JLS Section 3.3 this allows any ASCII based tool to process the source files:

    [...] The Java programming language specifies a standard way of transforming a program written in Unicode into ASCII that changes a program into a form that can be processed by ASCII-based tools. [...]

    This gives a fundamental guarantee for platform independence (independence of supported character sets) which has always been a key goal for the Java platform.

    Being able to write any Unicode character anywhere in the file is a neat feature, and especially important in comments, when documenting code in non-latin languages. The fact that it can interfere with the semantics in such subtle ways is just an (unfortunate) side-effect.

    There are many gotchas on this theme and Java Puzzlers by Joshua Bloch and Neal Gafter included the following variant:

    Is this a legal Java program? If so, what does it print?

    \u0070\u0075\u0062\u006c\u0069\u0063\u0020\u0020\u0020\u0020
    \u0063\u006c\u0061\u0073\u0073\u0020\u0055\u0067\u006c\u0079
    \u007b\u0070\u0075\u0062\u006c\u0069\u0063\u0020\u0020\u0020
    \u0020\u0020\u0020\u0020\u0073\u0074\u0061\u0074\u0069\u0063
    \u0076\u006f\u0069\u0064\u0020\u006d\u0061\u0069\u006e\u0028
    \u0053\u0074\u0072\u0069\u006e\u0067\u005b\u005d\u0020\u0020
    \u0020\u0020\u0020\u0020\u0061\u0072\u0067\u0073\u0029\u007b
    \u0053\u0079\u0073\u0074\u0065\u006d\u002e\u006f\u0075\u0074
    \u002e\u0070\u0072\u0069\u006e\u0074\u006c\u006e\u0028\u0020
    \u0022\u0048\u0065\u006c\u006c\u006f\u0020\u0077\u0022\u002b
    \u0022\u006f\u0072\u006c\u0064\u0022\u0029\u003b\u007d\u007d
    

    (This program turns out to be a plain "Hello World" program.)

    In the solution to the puzzler, they point out the following:

    More seriously, this puzzle serves to reinforce the lessons of the previous three: Unicode escapes are essential when you need to insert characters that can’t be represented in any other way into your program. Avoid them in all other cases.


    Source: Java: Executing code in comments?!

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(7条)

报告相同问题?

悬赏问题

  • ¥15 求差集那个函数有问题,有无佬可以解决
  • ¥15 【提问】基于Invest的水源涵养
  • ¥20 微信网友居然可以通过vx号找到我绑的手机号
  • ¥15 寻一个支付宝扫码远程授权登录的软件助手app
  • ¥15 解riccati方程组
  • ¥15 display:none;样式在嵌套结构中的已设置了display样式的元素上不起作用?
  • ¥15 使用rabbitMQ 消息队列作为url源进行多线程爬取时,总有几个url没有处理的问题。
  • ¥15 Ubuntu在安装序列比对软件STAR时出现报错如何解决
  • ¥50 树莓派安卓APK系统签名
  • ¥65 汇编语言除法溢出问题