Hiding payloads in Java source code strings

Java processes unicode escapes in string literals before parsing, so \u0022 can close a string and run code — Bambdas from untrusted sources can achieve RCE and must be validated first.