1717
1818
1919/**
20- * The Codec interface defines a set of methods for encoding and decoding application level encoding schemes,
21- * such as HTML entity encoding and percent encoding (aka URL encoding). Codecs are used in output encoding
20+ * The {@code Coded} interface defines a set of methods for encoding and decoding application level encoding schemes,
21+ * such as HTML entity encoding and percent encoding (aka URL encoding). {@code Coded}s are used in output encoding
2222 * and canonicalization. The design of these codecs allows for character-by-character decoding, which is
2323 * necessary to detect double-encoding and the use of multiple encoding schemes, both of which are techniques
2424 * used by attackers to bypass validation and bury encoded attacks in data.
25+ * <p>
26+ * Be sure to see the several <b>WARNING</b>s associated with the detailed
27+ * method descriptions. You will not find that in the "Method Summary" section
28+ * of the javadoc because that only shows the intial sentence.
2529 *
2630 * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) <a
2731 * href="http://www.aspectsecurity.com">Aspect Security</a>
@@ -52,15 +56,13 @@ public AbstractCodec() {
5256 }
5357
5458 /**
55- * WARNING!! {@code Character} based Codecs will silently transform code points that are not
59+ * {@inheritDoc}
60+ * </p><p>
61+ * <b>WARNING!!</b> {@code Character} based {@code Codec}s will silently transform code points that are not
5662 * legal UTF code points into garbage data as they will cast them to {@code char}s.
57- * </br></br>
58- * If you are implementing an {@code Integer} based codec, these will be silently discarded
63+ * Also, if you are implementing an {@code Integer} based codec, these will be silently discarded
5964 * based on the return from {@code Character.isValidCodePoint( int )}. This is the preferred
6065 * behavior moving forward.
61- *
62- *
63- * {@inheritDoc}
6466 */
6567 @ Override
6668 public String encode (char [] immune , String input ) {
@@ -79,19 +81,29 @@ public String encode(char[] immune, String input) {
7981 }
8082
8183 /**
82- * WARNING!!!! Passing a standard char to this method will resolve to the
83- * @see #encodeCharacter( char[], int )
84- * method instead of this one!!! YOU HAVE BEEN WARNED!!!!
85- *
8684 * {@inheritDoc}
85+ * <p>
86+ * <b>WARNING!!!!</b> Passing a standard {@code char} rather than {@code Character} to this method will resolve to the
87+ * {@link #encodeCharacter( char[], char )} method, which will throw an {@code IllegalArgumentException} instead.
88+ * YOU HAVE BEEN WARNED!!!!
8789 */
8890 @ Override
8991 public String encodeCharacter ( char [] immune , Character c ) {
9092 return "" +c ;
9193 }
9294
95+
96+ /**
97+ * To prevent accidental footgun usage and calling
98+ * @{link #encodeCharacter( char[], int)} when called with {@code char} and
99+ * {@code char} is first silently converted to {@code int} and then the
100+ * unexpected method is called.
101+ *
102+ * @throws IllegalArgumentException to indicate that you called the incorrect method.
103+ */
93104 public String encodeCharacter (char [] immune , char c ) {
94- throw new IllegalArgumentException ("You tried to call encodeCharacter with a char. Nope. Use Character instead!" );
105+ throw new IllegalArgumentException ("You tried to call encodeCharacter() with a char. Nope. " +
106+ "Use 'encodeCharacter( char[] immune, Character c)' instead!" );
95107 }
96108
97109 /* (non-Javadoc)
0 commit comments