# Hiding payloads in Java source code strings

DevFeed: [Hiding payloads in Java source code strings](<https://devfeed.tech/articles/hiding-payloads-in-java-source-code-strings-7680.md>)

Original publisher: [Read original article](<https://portswigger.net/research/hiding-payloads-in-java-source-code-strings>)

Author: Gareth Heyes

Published: 2024-01-23T15:00:00Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [Java](<https://devfeed.tech/topics/java.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Compiler](<https://devfeed.tech/topics/compiler.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [code](<https://devfeed.tech/tags/code.md>), [compiler](<https://devfeed.tech/tags/compiler.md>), [java](<https://devfeed.tech/tags/java.md>), [payload](<https://devfeed.tech/tags/payload.md>), [post](<https://devfeed.tech/tags/post.md>), [source](<https://devfeed.tech/tags/source.md>)

## AI overview

This article explains how Java Unicode escapes in source code strings can conceal payloads. It shows that encoded quotation marks can terminate a string during compilation and enable arbitrary command execution when code is run in a Bambda.

## Source excerpt

In this post we'll show you how Java handles unicode escapes in source code strings in a way you might find surprising - and how you can abuse them to conceal payloads. We recently released a powerful