tree 2a9b2e21d9cc934f20f10c31b6e8cfc2a6667260
parent 2e07f269b955675517f89c13631638840c5e3c9a
author Kevin Zhao <kevin8093@126.com> 1773885683 +0800
committer GitHub <noreply@github.com> 1773885683 -0400
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJpu1jzCRC1aQ7uu5UhlAAAbNYQACHKwRzlMisPHdPBa7OpJ7GS
 ZCP0BC7nqTJP2u0HwuL5M7TO+/KAEgRzaGsT+dm17pKsWZa2I/0Ow/N3todTyRu0
 dNImk6jL+t8liphpLSH52FgPvktqURryNRsUw6rOuYwbbLKrBx4TLSMALsWQNJWm
 tmaWJIkXEOZio/m7MVToinqXFdPbVd0naPyyIB3a9aryjPQaqTJ1h/qcMA3AMGYH
 VHhuFp0hEosHfOa/v0kuRH8niR2yPhjpLqFlhKfIHWBVh6PsyujW7qjddCO/U465
 ckGAwa+MET64iEVGTSvQ+R3SXfTuVSW1LPOZKOC9zOknpg3O6Zt6aIqCk1HGlzhk
 LbTj/ZgTDvvfElK6/UftE/8vjIQt0Hpj76HbddkqIAG9GP6wZX5IYpzNHKnarfqT
 YnYgae7MtIrZwLAAChPJFTiupm04rX47SWX3HZnDFqVL1jHTdmtuqDmSVqr41sTW
 Jqlzq3RITUMcvzvooDxtuUwBopzgDTeRJu2+MxdohTB7lK69QGrsTXHONZBvSkw9
 clvhzTeCpt0wfloaxB0RfROQM+NEGLeUujEFme9EWQjkH9urqP/IK+FjZlN/ompi
 g/bL04J6PlLdGVp/WVUrbMHMvyk8A4Q7+IlpG+3qtQrn+JgwBpMCIxnyrwabpgv5
 poimOziVsnlTkJIjaOcR
 =670a
 -----END PGP SIGNATURE-----
 

codegen: escape string default values to prevent code injection (#8964)

String default values parsed from .fbs schemas are un-escaped by the IDL
parser (e.g., \x22 becomes a raw " byte), but code generators embed these
raw values directly into generated source code string literals. This allows
specially crafted .fbs files to break out of string literals and inject
arbitrary code into generated C++, Rust, TypeScript, and Swift source.

Fix by adding EscapeCodeGenString() helper that re-escapes string content
before embedding, and applying it to all 7 affected injection points across
5 code generators (C++, Rust, TypeScript, Swift, FBS).

Resolves the TODO comments in idl_gen_cpp.cpp and idl_gen_rust.cpp.