Use relaxed JSON escaping for log bodies (#340)

* Use relaxed JSON escaping for log bodies

The body formatter and batch serializer build Utf8JsonWriters with no
options, so they use the default HTML-safe JavaScriptEncoder, which
unicode-escapes every quote, ', <, >, & and all non-ASCII characters.
Because Serilog quotes string property values by default, this makes most
stored Loki lines unreadable (a regression from v8.x, which formatted
bodies with Serilog's JsonValueFormatter and standard escaping).

Construct the writers with JsonWriterOptions(Encoder =
JavaScriptEncoder.UnsafeRelaxedJsonEscaping). Output stays valid JSON and
UTF-8, so consumers (including the json parser) are unaffected. Add a unit
test covering markup and non-ASCII characters.

* Harden escaping test: assert quotes render as \" not "

Addresses CodeRabbit review on #340. Assert at the decoded body level (the raw
HTTP payload embeds the body as a JSON string, double-escaping its quotes), so
a regression back to " for quotes is caught.

* Centralize relaxed JSON writer; add Format-path and label escaping tests

The relaxed-encoder JsonWriterOptions was defined twice (formatter and
serializer) with drifting comments, and each Utf8JsonWriter opted in per
construction site: a future writer that forgot the options argument would
silently revert to HTML-safe \uXXXX escaping with no compiler warning.

Extract a single Infrastructure.JsonWriterDefaults.createWriter as the one
way the sink builds a writer, so escaping cannot drift between sites. The
shared comment also corrects the description: the relaxed encoder still
escapes U+2028/U+2029 and DEL, so it is not "only what JSON mandates".

Add the two missing wire-format guards:
- the public LokiJsonTextFormatter.Format entry point (the sink fast path
  bypasses it, so its writer site had no test coverage);
- promoted label values (the envelope writer escapes label keys/values too).

The escaping tests sample neutral, multi-script non-ASCII (accented Latin
plus CJK) rather than a single script.

---------

Co-authored-by: Mykhailo Shevchuk <myte@ukr.net>

Author: olsh

src/Serilog.Sinks.Grafana.Loki/Infrastructure/JsonWriterDefaults.fs

@@ -0,0 +1,36 @@
+// Copyright 2020-2026 Mykhailo Shevchuk & Contributors
+//
+// Licensed under the MIT license;
+// you may not use this file except in compliance with the License.
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See LICENSE file in the project root for full license information.
+
+namespace Serilog.Sinks.Grafana.Loki.Infrastructure
+
+open System.Buffers
+open System.Text.Encodings.Web
+open System.Text.Json
+
+// Single source of truth for every Utf8JsonWriter the sink creates.
+//
+// The default Utf8JsonWriter encoder is HTML-safe and renders every '"', '<', '>', '&', '\'' and
+// all non-ASCII as \uXXXX, which makes the stored Loki log line unreadable. The relaxed encoder
+// escapes the JSON-mandatory set (quote, backslash, control chars) plus the line/paragraph
+// separators U+2028/U+2029 and DEL, and emits printable non-ASCII verbatim. Output stays valid
+// JSON (and valid UTF-8), so consumers are unaffected.
+//
+// Centralised behind createWriter so escaping cannot drift between writer sites: a writer built
+// the default way (`new Utf8JsonWriter(buffer)`) would silently re-introduce \uXXXX over part of
+// the payload, and no compiler warning catches the missing options argument.
+[<RequireQualifiedAccess>]
+module internal JsonWriterDefaults =
+
+    let relaxedOptions =
+        JsonWriterOptions(Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping)
+
+    /// Creates a Utf8JsonWriter over the buffer using the relaxed (readable) encoder.
+    let createWriter (buffer: PooledByteBufferWriter) =
+        new Utf8JsonWriter(buffer :> IBufferWriter<byte>, relaxedOptions)

src/Serilog.Sinks.Grafana.Loki/LokiJsonTextFormatter.fs

@@ -11,7 +11,6 @@
 namespace Serilog.Sinks.Grafana.Loki
 
 open System
-open System.Buffers
 open System.Text.Json
 open Serilog.Events
 open Serilog.Formatting
@@ -173,7 +172,7 @@ type LokiJsonTextFormatter(exceptionFormatter: ILokiExceptionFormatter, enrichTr
         use buffer = new PooledByteBufferWriter(256)
         // Throwaway writer + scratch for the message render. The internal sink path passes reused
         // instances instead; the public path stays allocation-light but fully thread-safe.
-        use jsonWriter = new Utf8JsonWriter(buffer :> IBufferWriter<byte>)
+        use jsonWriter = JsonWriterDefaults.createWriter buffer
         use messageBuffer = new PooledByteBufferWriter(128)
         use messageWriter = new Utf8TextWriter(messageBuffer)
         self.FormatToBuffer(logEvent, jsonWriter, messageWriter)

src/Serilog.Sinks.Grafana.Loki/Serialization.fs

@@ -30,7 +30,8 @@ type internal SerializationBuffers() =
     let main = new PooledByteBufferWriter(4096)
     let body = new PooledByteBufferWriter(256)
     let message = new PooledByteBufferWriter(256)
-    let bodyWriter = new Utf8JsonWriter(body :> IBufferWriter<byte>)
+
+    let bodyWriter = JsonWriterDefaults.createWriter body
     let messageWriter = new Utf8TextWriter(message)
 
     /// Envelope buffer holding the full push payload; read by LokiPushContent after serialize.
@@ -87,7 +88,7 @@ module internal Serialization =
             | :? LokiJsonTextFormatter as fmt when fmt.GetType() = typeof<LokiJsonTextFormatter> -> fmt
             | _ -> Unchecked.defaultof<LokiJsonTextFormatter>
 
-        use jsonWriter = new Utf8JsonWriter(buffers.Main :> IBufferWriter<byte>)
+        use jsonWriter = JsonWriterDefaults.createWriter buffers.Main
 
         // Reused stack scratch for the per-event Unix-nanosecond timestamp. Hoisted out of
         // the event loop so the localloc happens once per batch, not once per event. An

src/Serilog.Sinks.Grafana.Loki/Serilog.Sinks.Grafana.Loki.fsproj

@@ -48,6 +48,7 @@
         <!-- Infrastructure (no Serilog dependency) -->
         <Compile Include="Infrastructure\PooledByteBufferWriter.fs"/>
         <Compile Include="Infrastructure\Utf8TextWriter.fs"/>
+        <Compile Include="Infrastructure\JsonWriterDefaults.fs"/>
 
         <!-- Public contract types -->
         <Compile Include="LokiLabel.fs"/>

tests/Serilog.Sinks.Grafana.Loki.UnitTests/WireFormatTests.fs

@@ -252,6 +252,58 @@ let ``body: contains Message and MessageTemplate`` () : Task =
         test <@ hasMsg && hasTpl @>
     }
 
+[<Fact>]
+let ``body: quotes, markup and non-ASCII are not unicode-escaped`` () : Task =
+    task {
+        let handler, sink = makeSink id
+        use _ = sink
+        do! flush sink [ mkInfo [ "Note", box "a>b <c> & \"q\" café 日本語" ] ]
+        use doc = handler.LastBodyJson
+        let body = bodyStringOf (streamAt 0 doc) 0
+        // Relaxed escaping: '<' '>' '&' and non-ASCII stay verbatim and quotes use the JSON-standard
+        // \", never \uXXXX. The default HTML-safe encoder would render all of these as \uXXXX.
+        test <@ body.Contains("a>b <c> &") @>
+        test <@ body.Contains("café 日本語") @>
+        test <@ body.Contains("\\\"q\\\"") @>
+        test <@ not (body.Contains("\\u0022")) @>
+    }
+
+[<Fact>]
+let ``body: public Format path keeps quotes, markup and non-ASCII readable`` () =
+    // The sink fast path calls FormatToBuffer directly; this is the only coverage of the public
+    // ITextFormatter.Format entry point, whose Utf8JsonWriter is a separate construction site.
+    let formatter = LokiJsonTextFormatter() :> ITextFormatter
+    let event = mkInfo [ "Note", box "a>b <c> & \"q\" café 日本語" ]
+    use output = new System.IO.StringWriter()
+    formatter.Format(event, output)
+    let body = output.ToString()
+    use _ = JsonDocument.Parse(body) // output must stay valid JSON
+    test <@ body.Contains("a>b <c> &") @>
+    test <@ body.Contains("café 日本語") @>
+    test <@ body.Contains("\\\"q\\\"") @>
+    test <@ not (body.Contains("\\u")) @>
+
+[<Fact>]
+let ``labels: promoted label value keeps markup and non-ASCII verbatim`` () : Task =
+    task {
+        let handler, sink =
+            makeSink (fun o ->
+                { o with
+                    PropertiesAsLabels = [| "app" |]
+                })
+
+        use _ = sink
+        do! flush sink [ mkInfo [ "app", box "<svc> café 日本語" ] ]
+        use doc = handler.LastBodyJson
+        let raw = handler.LastBodyText
+        // The envelope writer escapes label keys/values too. The round-trip proves the label
+        // decodes back to the original; the raw scan proves it ships verbatim, not \uXXXX (a
+        // label-only regression would still decode correctly but leak escaped < or non-ASCII bytes).
+        test <@ labelOf "app" (streamAt 0 doc) = Some "<svc> café 日本語" @>
+        test <@ raw.Contains("<svc> café 日本語") @>
+        test <@ not (raw.Contains("\\u")) @>
+    }
+
 [<Fact>]
 let ``body: reserved property "Message" sanitized to "_Message"`` () : Task =
     task {