codegen: escape string default values to prevent code injection (#8964) String default values parsed from .fbs schemas are un-escaped by the IDL parser (e.g., \x22 becomes a raw " byte), but code generators embed these raw values directly into generated source code string literals. This allows specially crafted .fbs files to break out of string literals and inject arbitrary code into generated C++, Rust, TypeScript, and Swift source. Fix by adding EscapeCodeGenString() helper that re-escapes string content before embedding, and applying it to all 7 affected injection points across 5 code generators (C++, Rust, TypeScript, Swift, FBS). Resolves the TODO comments in idl_gen_cpp.cpp and idl_gen_rust.cpp.
FlatBuffers
FlatBuffers is a cross platform serialization library architected for maximum memory efficiency. It allows you to directly access serialized data without parsing/unpacking it first, while still having great forwards/backwards compatibility.
Build the compiler for flatbuffers (flatc)
Use cmake to create the build files for your platform and then perform the compilation (Linux example).
cmake -G "Unix Makefiles" make -j
Define your flatbuffer schema (.fbs)
Write the schema to define the data you want to serialize. See monster.fbs for an example.
Generate code for your language(s)
Use the flatc compiler to take your schema and generate language-specific code:
./flatc --cpp --rust monster.fbs
Which generates monster_generated.h and monster_generated.rs files.
Serialize data
Use the generated code, as well as the FlatBufferBuilder to construct your serialized buffer. (C++ example)
Transmit/store/save Buffer
Use your serialized buffer however you want. Send it to someone, save it for later, etc...
Read the data
Use the generated accessors to read the data from the serialized buffer.
It doesn't need to be the same language/schema version, FlatBuffers ensures the data is readable across languages and schema versions. See the Rust example reading the data written by C++.
Go to our landing page to browse our documentation.
Code generation and runtime libraries for many popular languages.
FlatBuffers does not follow traditional SemVer versioning (see rationale) but rather uses a format of the date of the release.
flatbuffers tag for any questions regarding FlatBuffers.To contribute to this project, see CONTRIBUTING.
Please see our Security Policy for reporting vulnerabilities.
Flatbuffers is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.