ServiceStack does not escape control characters in JSON

Question

ServiceStack's JsonSerializer does not seem to encode control characters correctly.

For example, this C# expression....

JsonSerializer.SerializeToString(new { Text = "\u0010" })

... evaluates to this...

{"Text":"?"}

... where the "?" is the literal control character.

Instead, according to http://www.json.org it should evaluate to this:

{"Text":"\u0010"}

Is this a known bug or am I missing something?

The bad JSON output by my services is causing errors during deserialization by my service consumers.

Answer 1

You need to tell the serializer to escape unicode characters.

JsConfig.EscapeUnicode = true;
JsonSerializer.SerializeToString(new{Text = "\u0010"});

The above evaluates to this:

{"Text":"\u0010"}

Answer 2

Thanks Mike, that works. But I think this approach escapes ALL non-ASCII Unicode characters in addition to control characters.

I'm expecting to have a lot of foreign language characters in my data (Arabic, for example) so this will cause significant size bloat versus just including those unescaped unicode characters in the JSON (which is still standard-compliant).

I imagine the purpose of EscapeUnicode = true is to produce JSON that can be stored or transmitted with simple ASCII encoding, which is certainly useful. And it apparently also encodes ASCII control characters as a side-effect which does solve my problem.

But in my opinion, JsonSerializer should escape control characters regardless of the EscapeUnicode setting since the standard requires it. I consider this a bug.

Since this is primarily a problem for me within my Service Stack services I also found this solution:

SetConfig(new EndpointHostConfig
{
  UseBclJsonSerializers = true
});

This tells Service Stack to use .NET's built-in DataContractJsonSerializer instead of Service Stack's JsonSerializer. I have verified that DataContractJsonSerializer does escape control.characters correctly.

So it appears that I need to choose between JsonSerializer with EscapeUnicode = true (faster but with bloated output) and DataContractJsonSerializer (slower but with compact Unicode output).