codegen: escape string default values to prevent code injection

[KevinZhao]

Summary

String default values parsed from .fbs schemas are un-escaped by the IDL parser (e.g., \x22 becomes a raw " byte), but code generators embed these raw values directly into generated source code string literals without re-escaping. This allows specially crafted .fbs files to inject arbitrary code into generated C++, Rust, TypeScript, and Swift source files.

Changes

Apply EscapeString() to re-escape string default values at all 7 affected code generation sites across 5 generators:

• C++ (idl_gen_cpp.cpp): bfbs_string literal + CreateString default
• Rust (idl_gen_rust.cpp): string default value
• TypeScript (idl_gen_ts.cpp): string default value
• Swift (idl_gen_swift.cpp): string reader default + 2 constructor defaults
• FBS (idl_gen_fbs.cpp): schema regeneration (strings only, not numeric defaults)

No new helpers introduced — all sites call flatbuffers::EscapeString() directly, per reviewer feedback.

Test plan

• Build passes (cmake --build build)
• Verified: \x22 in string defaults is correctly escaped to \" in generated C++ code
• CI tests pass (existing tests use normal string defaults, unaffected by this change)

Resolves the TODO comments in idl_gen_cpp.cpp and idl_gen_rust.cpp.

[jtdavis777]

hey @KevinZhao thank you for a fantastic PR and bug fix! This will take me a little time to ingest but I will run the workflows and plan to review and get merged.

[KevinZhao]

Thanks @aardappel — good call. Removed EscapeCodeGenString entirely and now call EscapeString directly at each codegen site. Since EscapeString already produces a properly quoted string, the callers no longer need to add \"..\" manually.

The diff no longer touches util.h — all changes are in the 5 codegen files using the existing EscapeString API.

[KevinZhao]

Hi @aardappel @jtdavis777 — I've addressed the review feedback (removed EscapeCodeGenString, now using EscapeString directly at each codegen site). The diff no longer touches util.h.

Happy to rebase on latest master if needed. Could you take another look when you get a chance?

issues were addressed by the PR creator -- will re-review myself :D

[jtdavis777]

@KevinZhao LGTM - would you mind at your leisure updating your PR description? will merge this anyway but would be nice if the description was accurate