Runtime: + sign is changing into \u002B using JsonSerializer.Serialize

[KamranShahid]

I have a .net core 3.1 application where through out System.Text.Json
I have couple of properties of string in my object which when ever there is + character it changes to \u002B during serialization.
Same thing working fine with newtonsoft.

var jsonRequest = JsonSerializer.Serialize<T>(req);
//var jsonRequest = JsonConvert.SerializeObject(req);//this works fine

I will also some non ascii message in some other properties like مرحبًا

[msftbot[bot]]

Tagging subscribers to this area: @jozkee
Notify danmosemsft if you want to be subscribed.

[GrabYourPitchforks]

The behavior you're seeing is intentional. See https://docs.microsoft.com/en-us/dotnet/standard/serialization/system-text-json-migrate-from-newtonsoft-how-to#minimal-character-escaping and https://docs.microsoft.com/en-us/dotnet/standard/serialization/system-text-json-how-to#customize-character-for more information and for workarounds.

[KamranShahid]

The behavior you're seeing is intentional. See https://docs.microsoft.com/en-us/dotnet/standard/serialization/system-text-json-migrate-from-newtonsoft-how-to#minimal-character-escaping and https://docs.microsoft.com/en-us/dotnet/standard/serialization/system-text-json-how-to#customize-character-for more information and for workarounds.

It's a big article and i am only having problem with one + sign .
Can you please bring out specific workaround.
Any possible JsonSerializerOptions

[GrabYourPitchforks]

Apologies, the deep links I posted appear to be broken.

In the first link, search for the text "__Minimal character escaping__".

In the second link, search for the text "__Serialize language character sets__". The example at that heading shows how to allow basic Latin + Cyrillic. In your case you could also allow Arabic (or specify UnicodeRanges.All if you want to allow most non-ASCII characters to go through).

The '+' character in particular has security impact, which is why the default behavior is to escape it. There is no easy way of allowing just that one character through.

[KamranShahid]

This single + character related thing is breaking all my implementation.
Looks like only ugly solution is to use string.replace for this \u002B to + replacement?

Just thinking there could be some way of doing it via JsonSerializerOptions

[KamranShahid]

At the moment used
JsonSerializerOptions jso = new JsonSerializerOptions();
jso.Encoder = System.Text.Encodings.Web.JavaScriptEncoder.UnsafeRelaxedJsonEscaping;

[GrabYourPitchforks]

Mind sharing how it's breaking your implementation? All JSON deserializers __must__ treat \u002B and + as completely identical when reading data. It is mandated by the JSON specification.

You can use UnsafeRelaxedJsonEscaping if needed. Note that we included _unsafe_ in the API name because you need to take extra precautions when using that API. See https://docs.microsoft.com/en-us/dotnet/api/system.text.encodings.web.javascriptencoder.unsaferelaxedjsonescaping and https://docs.microsoft.com/en-us/dotnet/standard/serialization/system-text-json-how-to#serialize-all-characters for further discussion (search the latter link for the text "__Caution__").

Edit: Also wanted to address this suggestion made earlier.

Looks like only ugly solution is to use string.replace for this \u002B to + replacement?

This isn't going to work. If you have a JSON string "\\u002B", this search-and-replace will result in the JSON string "\+", which corrupts the JSON payload.

[KamranShahid]

Ok. Then I need to check with third party Api with this behavior that whether they treat \u002B and +
as identical or not.

You are correct. i were just got distracted from the logs

[KamranShahid]

just observed that third party application (probably written in java) is not recognizing this. looks like i have to try with unescape otpion