reject hex letters in NumericEntityUnescaper decimal scan

Author: alhudz

src/main/java/org/apache/commons/lang3/text/translate/NumericEntityUnescaper.java

@@ -120,8 +120,10 @@ public int translate(final CharSequence input, final int index, final Writer out
                 }
             }
             int end = start;
-            // Note that this supports character codes without a ; on the end
-            while (end < seqEnd && CharUtils.isHex(input.charAt(end))) {
+            // Note that this supports character codes without a ; on the end.
+            // A decimal entity (&#...) only holds decimal digits; a-f are hex digits and must
+            // not be consumed here, otherwise the following text is swallowed into a failed parse.
+            while (end < seqEnd && (isHex ? CharUtils.isHex(input.charAt(end)) : CharUtils.isAsciiNumeric(input.charAt(end)))) {
                 end++;
             }
             final boolean semiNext = end != seqEnd && input.charAt(end) == ';';

src/test/java/org/apache/commons/lang3/text/translate/NumericEntityUnescaperTest.java

@@ -55,6 +55,15 @@ void testSupplementaryUnescaping() {
         assertEquals(expected, result, "Failed to unescape numeric entities supplementary characters");
     }
 
+    @Test
+    void testDecimalEntityFollowedByHexLetter() {
+        // A decimal entity ends at the first non-decimal character, so a following a-f letter is text, not part of the number.
+        final NumericEntityUnescaper neu = new NumericEntityUnescaper(NumericEntityUnescaper.OPTION.semiColonOptional);
+        assertEquals("0abc", neu.translate("&#48abc"), "Failed to stop a decimal entity at a trailing hex letter");
+        assertEquals("Test 0 not test", neu.translate("Test &#48 not test"), "Failed on a decimal entity terminated by a space");
+        assertEquals("0xyz", neu.translate("&#48xyz"), "Failed on a decimal entity terminated by a non-hex letter");
+    }
+
     @Test
     void testUnfinishedEntity() {
         // parse it