ColdFusion 2023 HF12 Finding - writeLog() and JSON

[obxBill]

ColdFusion 2023 HF12 Finding - writeLog() function.  Following CF2023 server update to HF12, If a JSON string is passed as part of the text input to the writeLog() function, it double quotes {""key"":""value""} all JSON key/value pairs in the log.  Prior to HF12, JSON was logged normally {"key":"value"}.  Anyone able to confirm/verify this finding and whether there is a way to resolve?  thx! 

[Dave Watts]

Try using single quotes to see what happens - but open a support ticket at tracker.adobe.com (I think that's the right URL) anyway.

[obxBill]

well, we are using serializeJSON() to create the json body, thus that function only creates valid {"key":"value"} json strings.  likely if could do single quote JSON, it will likely output as {"'key'":"'value'"}.  I will look at opening a tracker ticket based on the finding.  Perhaps there is a java argument possible to suppress some change in the CF engine tied to a update to writeLog().

Fortunately, CF continues to create valid JSON and this issue only ties to writing logs.

[Dave Watts]

You shouldn't have an issue with CF doubling single quotes. That said, I don't really see how you'd get to where you can control how the CF error logger rewrites the output of serializeJSON. You could create a temporary wrapper for the function that conditionally rewrites the quotes after the JSON has been created, based on a feature flag. I'm not sure it's worth the effort for you though.

[obxBill]

i was able to find a temp work around by running the JSON string through a replace() to remove all the quoted key/value pairs.  this allows the writeLog() to set the json into the log entry with no quotes, but well formed per other properties of JSON.  Finally, with the log recorded, the json can be extracted from the log and run through a repair tool to correct the JSON to properly quote key/value pairs.  Thus it allows JSON to be "repaired" for use in log analysis.

[Dave Watts]

I did a little research and unexpectedly learned that JSON doesn't allow single quotes as delimiters! Sorry about that. Your approach is probably best for now.