---
id: 5065
title: "Hiding payloads in Java source code strings"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/hiding-payloads-in-java-source-code-strings"
published_at: "2024-01-24T12:27:00Z"
tags: ["rce", "burp-suite", "java", "bambdas", "code-execution", "unicode-escapes"]
phying_url: "https://phying.com/item/5065"
lang: en
---

# Hiding payloads in Java source code strings

## Summary

Java processes unicode escapes in string literals before parsing, so \u0022 can close a string and run code — Bambdas from untrusted sources can achieve RCE and must be validated first.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2024-01-24T12:27:00Z
- **Original:** https://portswigger.net/research/hiding-payloads-in-java-source-code-strings
- **Phying News:** https://phying.com/item/5065