Fix code injection via unescaped doc comments in Java/Kotlin/C# generators

[YLChen-007]

Summary

Fix a Code Injection vulnerability (CWE-94 / CWE-116) in the flatc compiler where documentation comments (///) from .fbs schema files were directly concatenated into generated source code without sanitizing the block comment closing sequence */.

Details

When generating Java, Kotlin, or C# source code, flatc wraps documentation comments inside /** ... */ Javadoc/KDoc-style block comments. An attacker who provides a malicious .fbs schema can include the */ character sequence in a documentation comment to prematurely close the generated comment block, thereby injecting arbitrary code into the generated source files.

For example, this malicious schema:

table Pwn {
  /// */ public static void main(String[] args) { Runtime.getRuntime().exec("malicious_command"); } /*
  name: string;
}
root_type Pwn;

Would generate a Java file where the payload escapes the comment block and becomes executable code.

Fix

This PR sanitizes the */ sequence by replacing it with * / (inserting a space) before emitting it into the generated output. The fix is applied to all three locations where comment content is written:

1. GenComment() in src/code_generators.cpp — shared by the Java and C# generators
2. GenerateComment() in src/idl_gen_kotlin.cpp — Kotlin generator
3. GenerateComment() in src/idl_gen_kotlin_kmp.cpp — Kotlin KMP generator

Testing

• Built and verified the fix against a malicious PoC schema — the payload now stays safely inside the comment block
• All existing flattests pass: ALL TESTS PASSED

Before the patch (malicious code escapes the comment):

/**
 * */ public static void main(String[] args) { ... } /*
 */

After the patch (payload remains inside the comment):

/**
 * * / public static void main(String[] args) { ... } /*
 */

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.