From a68d68c4b31082f1960ca2ef6993b4141d858470 Mon Sep 17 00:00:00 2001
From: Spencer Young <spencer.young@spyoung.com>
Date: Tue, 26 Aug 2025 09:49:23 -0700
Subject: [PATCH] fix unwrap panics when unescaping invalid escape sequences

---
 src/de.rs | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/src/de.rs b/src/de.rs
index 5f8c6f7..9d19316 100644
--- a/src/de.rs
+++ b/src/de.rs
@@ -43,9 +43,27 @@ impl<'de, 'a> Deserializer<'de> for JSONValueDeserializer<'a> {
             JSONValue::Null => visitor.visit_unit(),
             JSONValue::Bool(b) => visitor.visit_bool(*b),
             JSONValue::DoubleQuotedString(s) | JSONValue::SingleQuotedString(s) => {
-                visitor.visit_str(unescape(s).unwrap().as_str())
+                match unescape(s) {
+                    Ok(unescaped) => {
+                        visitor.visit_str(unescaped.as_str())
+                    }
+                    Err(e) => {
+                        Err(de::Error::custom(e.to_string()))
+                    }
+                }
+
             }
-            JSONValue::Identifier(s) => visitor.visit_str(unescape(s).unwrap().as_str()),
+            JSONValue::Identifier(s) => {
+                match unescape(s) {
+                    Ok(unescaped) => {
+                        visitor.visit_str(unescaped.as_str())
+                    }
+                    Err(e) => {
+                        Err(de::Error::custom(e.to_string()))
+                    }
+                }
+
+            },
             JSONValue::JSONObject { key_value_pairs } => {
                 // Treat as a map
                 let mut map_deserializer = JSONMapAccess {
@@ -556,7 +574,17 @@ impl<'de, 'a> Deserializer<'de> for JSONValueDeserializer<'a> {
         match self.input {
             JSONValue::Identifier(s)
             | JSONValue::DoubleQuotedString(s)
-            | JSONValue::SingleQuotedString(s) => visitor.visit_str(unescape(s).unwrap().as_str()),
+            | JSONValue::SingleQuotedString(s) => {
+                match unescape(s) {
+                    Ok(unescaped) => {
+                        visitor.visit_str(unescaped.as_str())
+                    }
+                    Err(e) => {
+                        Err(de::Error::custom(e.to_string()))
+                    }
+                }
+
+            },
             _ => self.deserialize_any(visitor),
         }
     }