fix(core): correct continuation byte range in UTF-8 validator

[pritesh-4]

Summary

This Pull Request fixes a typographical bug in kong.tools.string.validate_utf8 where the byte boundary range for 2-byte UTF-8 sequences was incorrectly defined.

Specifically, the continuation byte's lower limit was written as \123 (decimal 123, representing ASCII {) instead of the correct \128 (decimal 128, representing 0x80). This bug allowed invalid 2-byte sequences with trailing ASCII punctuation or control characters (123..127) to pass UTF-8 validation checks and be saved into database schemas.

Background & Technical Context
In Lua, escape sequences inside string literals (e.g. \ddd) are parsed as decimal values by default, unlike other programming languages where they are parsed as octals.

According to Table 3-7 of the Unicode Standard (referenced in the function comments), a valid 2-byte UTF-8 sequence consists of:

A lead byte in the range 0xC2..0xDF (decimal 194..223).
A continuation byte in the range 0x80..0xBF (decimal 128..191).
Due to a typo on

kong/tools/string.lua:L254:
elseif i == find(str, "[\194-\223][\123-\191]", i) then i = i + 2

The range was specified as [\123-\191]. This means any lead byte in the 194..223 range followed by any byte between 123 (ASCII {) and 191 (e.g., 123 ({), 124 (|), 125 (}), 126 (~), 127 (DEL)) was incorrectly validated as a valid 2-byte UTF-8 sequence.

Changes Made

1. Code Fix
   Updated

kong/tools/string.lua
to adjust the 2-byte sequence validation pattern to use the correct \128 lower boundary.

• elseif i == find(str, "[\194-\223][\123-\191]", i) then i = i + 2

• elseif i == find(str, "[\194-\223][\128-\191]", i) then i = i + 2

Checklist

• [✔️] The Pull Request has tests
• A changelog file has been created under changelog/unreleased/kong or skip-changelog label added on PR if changelog is unnecessary. README.md
• [✔️] There is a user-facing docs PR against https://github.com/Kong/developer.konghq.com - PUT DOCS PR HERE

Issue reference

Fix #14971 _

[CLAassistant]

All committers have signed the CLA.