disallow control characers in stringsmain

1 files changed, 5 insertions, 3 deletions

diff --git a/json.sh b/json.sh
index 535f20f..42e2f35 100644
--- a/json.sh
+++ b/json.sh
@@ -28,8 +28,9 @@
 #
 # Assumptions:
 #  - `set -e`
-#  - Input is valid UTF-8
+#  - Input is valid UTF-8, and does not include U+0000
 #  - LC_* is set to a UTF-8 value
+#  - LC_COLLATE is set to C.UTF-8
 json_tokenize() {
 	local _json_token=$1
 
@@ -138,7 +139,7 @@ _json_array() {
 _json_string() {
 	_json_expect '"'
 	local _json_strval=''
-	local _json_re='^[^\"]+'
+	local _json_re=$'^[^\x01-\x1f"\\]+'
 	local _json_c _json_n _json_n2
 	while true; do
 		case "${_json_buf::1}" in
@@ -186,13 +187,14 @@ _json_string() {
 			'' )
 				_json_error 'unexpected EOF in string'
 				;;
-			* )
+			[\ -\[\]-$'\U0010FFFF'] )
 				# Consume multiple characters at once,
 				# or else this is horribly slow.
 				[[ $_json_buf =~ $_json_re ]]
 				_json_strval+=${BASH_REMATCH[0]}
 				_json_buf=${_json_buf#"${BASH_REMATCH[0]}"}
 				;;
+			*) _json_error 'illegal character in string: %q' "${json_buf::1}";;
 		esac
 	done
 }