[java-spring;kotlin-spring] fix values escaping

[Picazsoo]

OpenAPI values were being reused across incompatible output contexts: as raw specification data, already-escaped template text, documentation text, and Java/Kotlin source literals. This could double-escape values, alter their runtime meaning, generate invalid source, and, in some Kotlin annotation paths, allow a malicious specification value to terminate a generated string literal.

This PR introduces context-specific Java and Kotlin source/documentation escaping helpers and preserves raw value provenance where templates need it. Java Spring and Kotlin Spring templates now render OpenAPI text through the serializer required by each output context, including annotations, defaults, examples, enum wire values, paths, tags, and generated documentation.

It also corrects Spring form-default documentation: OpenAPI form-property defaults are labeled as OpenAPI schema defaults and generation logs a warning, because the generated Spring form binding does not apply them when a field is omitted.

Fixed issues

• Fixes [BUG][Kotlin] Operation Description Escapes Generated Annotation String and Injects a Spring Handler #23956

Scope and follow-up

This is an initial, focused fix for the Java Spring and Kotlin Spring generators. Similar raw-value/escaping problems exist in other generator families and output contexts, including Kotlin clients and kotlin-server; those are intentionally out of scope here.

The raw-value provenance and context-specific serializer approach established by this PR provides a reusable basis for addressing those cases after this change has been tested successfully in real-world specifications.

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Fixes double-escaping of OpenAPI values in the Spring and Kotlin Spring generators. Values were previously escaped during model construction and again in templates, producing artifacts like <= and \"; they are now preserved raw and escaped once for their output context.

Bug Fixes

• Adds Java and Kotlin source-literal and documentation helpers for all OpenAPI value contexts, including annotations, Javadocs, defaults, examples, paths, enum wire values, and info metadata.
• Preserves UUID parameter serialization, stabilizes date-time defaults as full ISO-8601 offsets, and updates generated Spring samples.
• Marks schema defaults that Spring form bindings cannot enforce as "OpenAPI schema default" in generated Javadocs.
• Adds regression coverage; descriptions ending in whitespace may now produce an extra * line in generated Javadocs.

^{Written for commit 4e275de. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 341 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 339 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 364 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 379 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 379 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 379 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 115 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="modules/openapi-generator/src/test/java/org/openapitools/codegen/kotlin/spring/KotlinSpringServerCodegenTest.java">

<violation number="1" location="modules/openapi-generator/src/test/java/org/openapitools/codegen/kotlin/spring/KotlinSpringServerCodegenTest.java:4538">
P2: The new DiscriminatorParent assertion expects source `name = "kind$\"\\name"` (two backslash chars before `name`), but the YAML mapping key `'kind$\"\\name'` contains two literal backslashes, and `kotlinStringLiteral` escapes each backslash as `\\` (as the FormFeed assertion in the same file confirms). Correct escaping would produce four backslashes, so either this assertion would fail against correct generator output, or the generated discriminator mapping silently drops a backslash. Verify the actual rendered source and align the assertion with the true YAML value.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The new DiscriminatorParent assertion expects source name = "kind$\"\\name" (two backslash chars before name), but the YAML mapping key 'kind$\"\\name' contains two literal backslashes, and kotlinStringLiteral escapes each backslash as \\ (as the FormFeed assertion in the same file confirms). Correct escaping would produce four backslashes, so either this assertion would fail against correct generator output, or the generated discriminator mapping silently drops a backslash. Verify the actual rendered source and align the assertion with the true YAML value.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At modules/openapi-generator/src/test/java/org/openapitools/codegen/kotlin/spring/KotlinSpringServerCodegenTest.java, line 4538:

<comment>The new DiscriminatorParent assertion expects source `name = "kind$\"\\name"` (two backslash chars before `name`), but the YAML mapping key `'kind$\"\\name'` contains two literal backslashes, and `kotlinStringLiteral` escapes each backslash as `\\` (as the FormFeed assertion in the same file confirms). Correct escaping would produce four backslashes, so either this assertion would fail against correct generator output, or the generated discriminator mapping silently drops a backslash. Verify the actual rendered source and align the assertion with the true YAML value.</comment>

<file context>
@@ -4532,7 +4532,13 @@ public void kotlinSourceLiteralsEscapePathsContextPathsAndOAuthAnnotations() thr
+                "java.net.URI.create(\"https://example.test/\\$uri\")");
+        assertFileContains(controllerFiles.get("DiscriminatorParent.kt").toPath(),
+                "property = \"\\$kind\"",
+                "name = \"kind\\$\\\"\\\\name\"",
+                "name = \"mapping\\$\\\"\\\\name\"");
+        assertFileContains(controllerFiles.get("DiscriminatorChild.kt").toPath(),
</file context>

[Picazsoo]

This appears to be a false positive. The actual YAML key 'kind$"\name' contains one literal backslash. That becomes two in generated Kotlin source, represented by four in the Java test string. The assertion is correct; no backslash is lost.

[cubic-dev-ai]

All reported issues were addressed across 7 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>