I don't see how you can classify that as an abstraction leak but if
(for some reason) you do, you need to include control characters
0-32 (apart from tab, newline etc) and the three character sequence
]]>
conversely while you do need to quote U+0001 you do not need to quote
" ' or > (other than when used in ]]>)
you only need to quote < and &
> Does the JSON abstraction leak?
in the weird sense that you are using the phrase here then yes any
syntax with any grammar will leak, you can not use " in a "-delimited
string without some level of quoting.
David