{"record":{"id":"087d4f705251c747","repo":"quarkusio/quarkus","slug":"control-characters-not-allowed-in-json-string-087d4f","errorCode":null,"errorMessage":"Control characters not allowed in json string","messagePattern":"Control characters not allowed in json string","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"independent-projects/bootstrap/json/src/main/java/io/quarkus/bootstrap/json/JsonReader.java","lineNumber":195,"sourceCode":"     * |----- 'r'\n     * |----- 't'\n     * |----- 'u' hex hex hex hex\n     */\n    private JsonString readString() {\n        position++;\n\n        int start = position;\n        // Substring on string values that contain unicode characters won't work,\n        // because there are more characters read than actual characters represented.\n        // Use StringBuilder to buffer any string read up to unicode,\n        // then add unicode values into it and continue as usual.\n        StringBuilder unescapedValue = null;\n\n        while (position < length) {\n            final int ch = nextChar();\n\n            if (Character.isISOControl(ch)) {\n                throw new IllegalArgumentException(\"Control characters not allowed in json string\");\n            }\n\n            if ('\"' == ch) {\n                final String value;\n                if (unescapedValue == null) {\n                    value = text.substring(start, position - 1);\n                } else {\n                    value = unescapedValue.toString();\n                }\n                // End of string\n                return new JsonString(value);\n            }\n\n            if ('\\\\' == ch) {\n                if (unescapedValue == null) {\n                    unescapedValue = new StringBuilder().append(text, start, position - 1);\n                }\n                final int escaped = nextChar();","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/bootstrap/json/src/main/java/io/quarkus/bootstrap/json/JsonReader.java#L177-L213","documentation":"JSON strings may not contain raw control characters (ISO control characters, e.g. newline, tab) — they must be escaped as \\n, \\t, etc. readString() enforces this and throws IllegalArgumentException when it encounters an unescaped control character inside a string literal.","triggerScenarios":"A JSON string contains a literal newline, tab, or other control byte instead of its escaped form, e.g. \"line1\nline2\" written with a real newline inside the quotes.","commonSituations":"Hand-pasting multi-line text into a JSON string; log files or terminal output embedded raw in JSON; data coming from a source that doesn't escape control bytes.","solutions":["Escape the control characters in the string: replace raw newline with \\n, tab with \\t, etc.","Remove the raw control characters or sanitize/normalize the text before parsing","Produce the JSON with a serializer that escapes control characters automatically instead of hand-writing it"],"exampleFix":"// before\n{\"text\":\"line1\nline2\"}\n// after\n{\"text\":\"line1\\nline2\"}","handlingStrategy":"validation","validationCode":"String sanitize(String s) {\n    StringBuilder sb = new StringBuilder(s.length());\n    for (int i = 0; i < s.length(); i++) {\n        char c = s.charAt(i);\n        if (Character.isISOControl(c)) {\n            sb.append(String.format(\"\\\\u%04x\", (int) c));\n        } else {\n            sb.append(c);\n        }\n    }\n    return sb.toString();\n}\n// apply sanitize to any text embedded in JSON strings before parsing/serializing","typeGuard":null,"tryCatchPattern":"try {\n    JsonValue v = new JsonReader(text).read();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Control characters not allowed in json string\")) {\n        // re-run with escaped control chars or reject the input\n    }\n}","preventionTips":["Escape newlines/tabs as \\n, \\t inside JSON strings — never embed raw control bytes","Use a serializer to produce JSON from untrusted text instead of hand-writing","Strip or normalize control characters in ingested text before embedding it in JSON"],"tags":["json","parser","escaping"],"backgroundTag":"invalid-json-string-escape","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}