)]}'
{
  "commit": "8afb68f074b95b748425a5649728eb9fba3bc50b",
  "tree": "2a9b2e21d9cc934f20f10c31b6e8cfc2a6667260",
  "parents": [
    "2e07f269b955675517f89c13631638840c5e3c9a"
  ],
  "author": {
    "name": "Kevin Zhao",
    "email": "kevin8093@126.com",
    "time": "Thu Mar 19 10:01:23 2026 +0800"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Wed Mar 18 22:01:23 2026 -0400"
  },
  "message": "codegen: escape string default values to prevent code injection (#8964)\n\nString default values parsed from .fbs schemas are un-escaped by the IDL\nparser (e.g., \\x22 becomes a raw \" byte), but code generators embed these\nraw values directly into generated source code string literals. This allows\nspecially crafted .fbs files to break out of string literals and inject\narbitrary code into generated C++, Rust, TypeScript, and Swift source.\n\nFix by adding EscapeCodeGenString() helper that re-escapes string content\nbefore embedding, and applying it to all 7 affected injection points across\n5 code generators (C++, Rust, TypeScript, Swift, FBS).\n\nResolves the TODO comments in idl_gen_cpp.cpp and idl_gen_rust.cpp.",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ffd94e45eab351c7f85d718615c9be212562d68a",
      "old_mode": 33188,
      "old_path": "src/idl_gen_cpp.cpp",
      "new_id": "9ad18a7b4830836e310a8851b143bd5e8b4b943c",
      "new_mode": 33188,
      "new_path": "src/idl_gen_cpp.cpp"
    },
    {
      "type": "modify",
      "old_id": "da4289587b9b974241ce0657f60b48debc9ab9fc",
      "old_mode": 33188,
      "old_path": "src/idl_gen_fbs.cpp",
      "new_id": "0acd7e49a4df9acd5fdec33e8ada5968afde99f3",
      "new_mode": 33188,
      "new_path": "src/idl_gen_fbs.cpp"
    },
    {
      "type": "modify",
      "old_id": "3430a3486c68c4f956dc3d8f4c21f051d47cc023",
      "old_mode": 33188,
      "old_path": "src/idl_gen_rust.cpp",
      "new_id": "d62bbffa4de5213f36e684ae4712729d3c9a1187",
      "new_mode": 33188,
      "new_path": "src/idl_gen_rust.cpp"
    },
    {
      "type": "modify",
      "old_id": "f926aa5d4ffcc3af73c22556cb3d7b90cc7e95b3",
      "old_mode": 33188,
      "old_path": "src/idl_gen_swift.cpp",
      "new_id": "f534ca254f57a9f56b828bb28569489b78a4c801",
      "new_mode": 33188,
      "new_path": "src/idl_gen_swift.cpp"
    },
    {
      "type": "modify",
      "old_id": "9bd00d0e383a34c2316c2019b3885a294a1b4fbb",
      "old_mode": 33188,
      "old_path": "src/idl_gen_ts.cpp",
      "new_id": "8d02b8eb459fec638a4a77e41da6ce890cfb03dc",
      "new_mode": 33188,
      "new_path": "src/idl_gen_ts.cpp"
    }
  ]
}