Throw error on control chars in JSON string

npm/index.js

@@ -63,7 +63,7 @@ async function runTransforms(json, args) {
     console.error(
       `\n  ${pre} ${code} ${post}\n` +
       `  ${' '.repeat(pre.length + 1)}${'^'.repeat(code.length)}\n` +
-      `\n${err.stack || err}`
+      `\n${err.stack || err}`,
     )
   }
 }
@@ -263,7 +263,7 @@ function* parseJson(stdin) {
             'f': '\f',
             'n': '\n',
             'r': '\r',
-            't': '\t'
+            't': '\t',
           }[lastChar]
           if (!escapedChar) {
             throw new SyntaxError(errorSnippet())
@@ -275,6 +275,8 @@ function* parseJson(stdin) {
         escaped = true
       } else if (lastChar === '"') {
         break
+      } else if (lastChar < '\x1F') {
+        throw new SyntaxError(errorSnippet(`Unescaped control character ${JSON.stringify(lastChar)}`))
       } else if (lastChar === undefined) {
         throw new SyntaxError(errorSnippet())
       } else {
@@ -545,8 +547,8 @@ function stringify(value, isPretty = false) {
           (key) =>
             `${getIndent(level + 1)}${colors.key}"${key}"${colors.reset}: ${stringifyValue(
               value[key],
-              level + 1
-            )}`
+              level + 1,
+            )}`,
         )
         .join(',\n')
       return `{\n${entries}\n${getIndent(level)}}`

npm/test.js

@@ -24,7 +24,7 @@ void async function main() {
   })
 
   await test('format - escape newline', async t => {
-    const {stdout} = await run('{"foo": "bar\nbaz"}')
+    const {stdout} = await run(`{"foo": "bar\\\\nbaz"}`)
     t.equal(stdout, '{\n  "foo": "bar\\nbaz"\n}\n')
   })
 
@@ -47,6 +47,12 @@ void async function main() {
     t.ok(stderr.includes('SyntaxError'))
   })
 
+  await test('parseJson - string control chars', async t => {
+    const {stderr, status} = await run('"\t"')
+    t.equal(status, 1)
+    t.ok(stderr.includes('SyntaxError'))
+  })
+
   await test('parseJson - numbers', async t => {
     t.equal((await run('1.2e300')).stdout, '1.2e+300\n')
     t.equal((await run('123456789012345678901234567890')).stdout, '123456789012345678901234567890\n')