@koralabs/kora-labs-common 6.6.3 → 6.6.4

package/logger/index.d.ts

@@ -37,4 +37,5 @@ export declare class Logger {
     } | string): void;
     private static log_entry;
     private static colorize;
+    private static escapeJsonStringContent;
 }

package/logger/index.js

@@ -102,11 +102,11 @@ class Logger {
     }
     static log_entry(category, message, event, milliseconds, count, dimensions, context) {
         const now = new Date().toISOString();
-        message = message.replace(/\\/g, '\\\\').replace(/"/g, '\\"'); // escape double quotes and already escaped escapes
+        message = Logger.escapeJsonStringContent(message);
         const logCategory = category !== null && category !== void 0 ? category : LogCategory.INFO;
         const logCategoryColor = constants_1.IS_LOCAL ? LOCAL_CATEGORY_COLORS[logCategory] : undefined;
         const displayCategory = logCategoryColor ? this.colorize(logCategory, logCategoryColor) : logCategory;
-        const log_event = event ? `, "event": "${event}"` : '';
+        const log_event = event ? `, "event": "${Logger.escapeJsonStringContent(event)}"` : '';
         const log_milliseconds = milliseconds != undefined && milliseconds != null ? `, "milliseconds": ${milliseconds}` : '';
         const log_count = count != undefined && count != null ? `, "count": ${count}` : '';
         const log_dimensions = dimensions && Object.keys(dimensions).length ? `, "dimensions": ${JSON.stringify(dimensions)}` : '';
@@ -132,6 +132,54 @@ class Logger {
     static colorize(value, ansiColor) {
         return `${ansiColor}${value}${ANSI_RESET}`;
     }
+    // Escape characters that JSON forbids inside a string value: backslash,
+    // double quote, and control chars 0x00-0x1F. ESC (0x1B) is left alone so
+    // ANSI color sequences from `colorize`/`Logger.local` keep rendering on
+    // developer terminals; in production no ANSI is ever introduced, so the
+    // emitted line is valid JSON. Newlines/tabs in error stacks would otherwise
+    // produce invalid JSON that downstream consumers (CloudWatch subscribers,
+    // app-alerts ingestion) can't peel — the previous regex only handled \\ and
+    // \", letting stack traces through unescaped.
+    static escapeJsonStringContent(s) {
+        let out = '';
+        for (let i = 0; i < s.length; i++) {
+            const ch = s.charCodeAt(i);
+            if (ch === 0x5c) {
+                out += '\\\\';
+                continue;
+            }
+            if (ch === 0x22) {
+                out += '\\"';
+                continue;
+            }
+            if (ch === 0x08) {
+                out += '\\b';
+                continue;
+            }
+            if (ch === 0x09) {
+                out += '\\t';
+                continue;
+            }
+            if (ch === 0x0a) {
+                out += '\\n';
+                continue;
+            }
+            if (ch === 0x0c) {
+                out += '\\f';
+                continue;
+            }
+            if (ch === 0x0d) {
+                out += '\\r';
+                continue;
+            }
+            if (ch < 0x20 && ch !== 0x1b) {
+                out += '\\u' + ch.toString(16).padStart(4, '0');
+                continue;
+            }
+            out += s[i];
+        }
+        return out;
+    }
 }
 exports.Logger = Logger;
 Logger.isInitialized = false;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@koralabs/kora-labs-common",
-    "version": "6.6.3",
+    "version": "6.6.4",
     "description": "Kora Labs Common Utilities",
     "main": "index.js",
     "types": "index.d.ts",