security: sanitize schema strings in code generators

[mohammadmseet-hue]

Summary

The C++, PHP, and Rust code generators concatenate parsed schema string values directly into generated source code without escaping. A crafted .fbs schema with a malicious file_extension or native_include value can inject arbitrary code into the generated output.

This adds SanitizeStringForCodeGen() to escape backslashes, quotes, newlines, and control characters before embedding schema strings. Applied to all affected code paths.

Similar to the fix for CVE-2023-36665 in protobuf's ruby_package generator. The Python generator already hex-escapes file_identifier, confirming this risk was previously recognized.

Changes

• include/flatbuffers/util.h — new SanitizeStringForCodeGen() utility
• src/idl_gen_cpp.cpp — sanitize file_extension and native_include
• src/idl_gen_php.cpp — sanitize file_extension
• src/idl_gen_rust.cpp — sanitize file_extension

Reproduction

table Monster { name:string; }
root_type Monster;
file_extension "ext\";\n}\n#include <cstdlib>\nstatic struct _X { _X() { system(\"id\"); } } _x;\ninline const char* _D() { return \"";

Running flatc --cpp on this schema generates a header with a static initializer that executes system("id") when compiled and run.