[java] Reject unescaped control characters in JSON strings

RFC 8259 §7 requires characters U+0000..U+001F to be escaped inside
JSON strings. readString() previously appended them silently, so
inputs containing a literal newline / tab / etc. inside quotes were
accepted.

Author: shs96c

java/src/org/openqa/selenium/json/JsonInput.java

@@ -586,6 +586,13 @@ private String readString() {
           readEscape(builder);
           break;
         default:
+          // RFC 8259 §7: characters U+0000..U+001F MUST be escaped.
+          if (c < 0x20) {
+            throw new JsonException(
+                String.format(
+                    "Illegal unescaped control character U+%04X in string. %s",
+                    (int) c, input));
+          }
           builder.append(c);
       }
     }

java/test/org/openqa/selenium/json/JsonInputTest.java

@@ -291,6 +291,22 @@ void shouldBeAbleToReadNonWellFormedDataLongerThanReadBuffer() {
     }
   }
 
+  @Test
+  void shouldRejectUnescapedControlCharactersInStrings() {
+    // RFC 8259 §7: characters U+0000..U+001F MUST be escaped in JSON strings.
+    // A literal newline / tab / etc. inside quotes is not valid JSON.
+    try (JsonInput input = newInput("\"a\nb\"")) {
+      assertThatExceptionOfType(JsonException.class)
+          .isThrownBy(input::nextString)
+          .withMessageStartingWith("Illegal unescaped control character");
+    }
+
+    // Escaped equivalents are still fine.
+    try (JsonInput input = newInput("\"a\\nb\"")) {
+      assertThat(input.nextString()).isEqualTo("a\nb");
+    }
+  }
+
   @Test
   void nullInputsShouldCoerceAsNullValues() throws IOException {
     try (InputStream is = new ByteArrayInputStream(new byte[0]);