Reject sign characters in UnicodeUnescaper hex values

src/main/java/org/apache/commons/lang3/text/translate/UnicodeUnescaper.java

@@ -59,6 +59,11 @@ public int translate(final CharSequence input, final int index, final Writer out
                 // Get 4 hex digits
                 final CharSequence unicode = input.subSequence(index + i, index + i + 4);
 
+                final char firstChar = unicode.charAt(0);
+                if (firstChar == '+' || firstChar == '-') {
+                    // Integer.parseInt accepts a leading sign, but a Unicode value is unsigned hex.
+                    throw new IllegalArgumentException("Sign character in unicode value: '" + unicode + "'");
+                }
                 try {
                     final int value = Integer.parseInt(unicode.toString(), 16);
                     out.write((char) value);

src/test/java/org/apache/commons/lang3/text/translate/UnicodeUnescaperTest.java

@@ -40,6 +40,23 @@ void testLessThanFour() {
                 "A lack of digits in a Unicode escape sequence failed to throw an exception");
     }
 
+    @Test
+    void testSignedValue() {
+        final UnicodeUnescaper uu = new UnicodeUnescaper();
+
+        // Integer.parseInt accepts a leading sign, so these used to decode to a bogus char instead of throwing.
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> uu.translate("\\u-047"),
+                "A signed Unicode escape sequence failed to throw an exception");
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> uu.translate("\\u++0047"),
+                "A signed Unicode escape sequence failed to throw an exception");
+        // The documented u+ notation is still accepted.
+        assertEquals("G", uu.translate("\\u+0047"), "Failed to unescape Unicode characters with 'u+' notation");
+    }
+
     // Requested in LANG-507
     @Test
     void testUPlus() {