From 3de31677d36aa4f82d4d99898902d7bcf398e666 Mon Sep 17 00:00:00 2001
From: ExtReMLapin <3909752+ExtReMLapin@users.noreply.github.com>
Date: Tue, 5 Mar 2024 17:33:08 +0100
Subject: [PATCH] grammars : blacklists character control set (#5888)

* Prevent control characters from being served in json string

* Prevent control characters from being served in json string (array)
---
 grammars/json.gbnf     | 2 +-
 grammars/json_arr.gbnf | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/grammars/json.gbnf b/grammars/json.gbnf
index a9537cdf9..a8a80752e 100644
--- a/grammars/json.gbnf
+++ b/grammars/json.gbnf
@@ -15,7 +15,7 @@ array  ::=
 
 string ::=
   "\"" (
-    [^"\\] |
+    [^"\\\x7F\x00-\x1F] |
     "\\" (["\\/bfnrt] | "u" [0-9a-fA-F] [0-9a-fA-F] [0-9a-fA-F] [0-9a-fA-F]) # escapes
   )* "\"" ws
 
diff --git a/grammars/json_arr.gbnf b/grammars/json_arr.gbnf
index ef53e77a0..31a3202f8 100644
--- a/grammars/json_arr.gbnf
+++ b/grammars/json_arr.gbnf
@@ -24,7 +24,7 @@ array  ::=
 
 string ::=
   "\"" (
-    [^"\\] |
+    [^"\\\x7F\x00-\x1F] |
     "\\" (["\\/bfnrt] | "u" [0-9a-fA-F] [0-9a-fA-F] [0-9a-fA-F] [0-9a-fA-F]) # escapes
   )* "\"" ws