[Arawoof06]

Purpose

In Strictness.STRICT, unescaped control characters and unpaired surrogates (#3116) are only rejected in nextQuotedValue, so skipValue() still accepts them. A strict Gson therefore accepts {"a":"x<TAB>y","b":1} or {"a":"\uD800","b":1} when deserializing into a class without field a, while the same input is rejected when a is read.

Description

In strict mode skipQuotedValue now reads the string through nextQuotedValue, so skipped values and names get the same checks as nextString() and nextName(). Legacy strict and lenient modes keep the existing fast skip path.

Checklist

• New code follows the Google Java Style Guide
  This is automatically checked by mvn verify, but can also be checked on its own using mvn spotless:check.
  Style violations can be fixed using mvn spotless:apply; this can be done in a separate commit to verify that it did not cause undesired changes.
• If necessary, new public API validates arguments, for example rejects null
• New public API has Javadoc
  • Javadoc uses @since $next-version$
    ($next-version$ is a special placeholder which is automatically replaced during release)
• If necessary, new unit tests have been added
  • Assertions in unit tests use Truth, see existing tests
  • No JUnit 3 features are used (such as extending class TestCase)
  • If this pull request fixes a bug, a new test was added for a situation which failed previously and is now fixed
• mvn clean verify javadoc:jar passes without errors

[Arawoof06]

I think this one's a false positive. com.google.gson.stream is annotated @CheckReturnValue, so the result of nextQuotedValue has to be assigned to something, and unused is the Error Prone convention for intentionally discarding it. It's the same shape as char unused = readEscapeCharacter() a few lines further down in this same method, and int unused = nextNonWhitespace(true) elsewhere in the file. Dropping the assignment would fail the build, and CodeQL's unread-local-variable query doesn't honor @SuppressWarnings("unused") either, so there isn't much to change on my side. Happy to adjust if you'd rather I avoid materializing the string on the skip path.