Converting XML to JSON does not escape invalid string characters

[caminad]

Calling convert(xml, { format: 'json' }) on XML that includes a text node containing unescaped control characters produces JSON containing those characters:

> console.log(convert('<a>b\nc</a>', { format: 'json' }))
{"a":"b
c"}

Similarly other invalid characters are not escaped when emitting JSON. According to the spec, %x00-19, \ and " must be escaped in JSON strings.

To Reproduce

const { convert } = require('xmlbuilder2');

const invalidChars = Array.from(Array(0x20), (_, i) => {
  return String.fromCharCode(i);
}).concat('"', '\\');

const xml = convert(
  `<a>${invalidChars.map((c) => `<b>_${c}_</b>`).join('\n')}</a>`
);

const json = convert(xml, { format: 'json' });

JSON.parse(json); // throws

Expected behavior

JSON.parse(json); // should not throw

const obj = convert(xml, { format: 'object' });

JSON.stringify(obj) === json; // should be true

Version:

• node.js: v14.6.0
• xmlbuilder2 2.2.0@master

Additional context

I hit this issue when serializing responses from a SOAP endpoint which contain newline characters within embedded escaped HTML (something like <desc>&lt;p&gt;First&lt;/p&gt;\n&lt;p&gt;Second&lt;/p&gt;</desc>). I was initially doing JSON.stringify(convert(xml, { format: 'object' })) before I discovered this API, which seems like a reasonable workaround.

Thanks for this awesome library! ✨