Repository navigation
Description
Describe the bug
Alan Zimmer's November 6, 2026 audit of com.azure:azure-cosmos:4.84.0-beta.1 reports that Java regex replacement processing consumes the intended escape backslash when constructing ORDER BY continuation predicates. A stored value a"b becomes the malformed SQL literal "a"b" in a resumed query. Backslashes and control characters are also unhandled and can change comparison values. Reported priority: P2.
Exception or Stack Trace
No SDK/service stack trace supplied. The reported helper output contains a malformed SQL string literal.
To Reproduce
Construct an ORDER BY continuation predicate for a stored value containing a quote, such as a"b. Also cover backslashes and control characters. Compare uninterrupted and resumed query execution and verify that continuation predicates preserve the original comparison values.
Code Snippet
No complete executable snippet supplied. Reported location: OrderByDocumentQueryExecutionContext.java:444-447 in the audited source. The exact helper reportedly emitted "a"b" for input a"b in a standalone JDK probe.
Expected behavior
String comparison values are correctly serialized or parameterized in continuation predicates. Resumed queries are valid and return results equivalent to uninterrupted queries for quotes, backslashes, and control characters.
Screenshots
N/A.
Setup (please complete the following information):
- OS: Not reported.
- IDE: Not reported.
- Library/Libraries:
com.azure:azure-cosmos:4.84.0-beta.1. - Java version: JDK probe; exact version not supplied.
- App Server/Environment: ORDER BY query continuation.
- Frameworks: Not reported.
Dependency mismatch: Not indicated; dependency tree/logs were not supplied.
Additional context
Proposed fix from the audit: use proper JSON string serialization or SQL parameters instead of ad hoc regex escaping.
Regression coverage: compare uninterrupted and resumed queries with string values containing quotes, backslashes, and control characters; assert valid predicates and identical comparison values/results.
Evidence: Alan reproduced the exact helper's malformed output at the standalone JDK-helper level, not through live query execution. No live Cosmos calls or full SDK test suite were run, and no repository files were changed. This issue tracks validation and implementation of the proposed fix, not an already-applied fix.
Information Checklist
- Bug Description Added
- Repro Steps Added
- Setup information Added
Activity
Fix escaping for Cosmos DB ORDER BY continuation strings