Bug#1100715: libjson-glib-1.0-0: Missing escape of ASCII “US” control character may result in broken JSON output

[test]

Package: libjson-glib-1.0-0
Version: 1.10.6+ds-1
Severity: important

Dear Maintainer,

when an input string contains the “US” (0x1f) control character, it is not
encoded in the JSON output as required by RFC 8259. As a result, a consumer
application will usually reject the JSON. The bug is present in *all* released
versions of the library, including the Bookworm and Testing (Trixie) packages.

See https://gitlab.gnome.org/GNOME/json-glib/-/issues/79 for the full bug
report and a small test case to reproduce the issue.

The fix is a one-liner (actually adding a single char), see
https://gitlab.gnome.org/GNOME/json-
glib/-/merge_requests/95/diffs#36b33137ef9e9aaf2eb982f617ab2e1c704604e9, but
has not yet been released.
It would be great if it could be added to the packages as to avoid the sporadic
“mysterious” errors in consumers iff they receive the broken JSON input.


-- System Information:
Debian Release: trixie/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.12.17-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libjson-glib-1.0-0 depends on:
ii  libc6                    2.41-4
ii  libglib2.0-0t64          2.84.0-2
ii  libjson-glib-1.0-common  1.10.6+ds-1

libjson-glib-1.0-0 recommends no packages.

libjson-glib-1.0-0 suggests no packages.

-- no debconf information