Comment 10 for bug 878508

Ok, you're correct about that. Apparently file:write() still does XML-ish serialization by default. So that explains the introduction of entities and character references.

However, there is still a bug here, as far as I can tell. I'm attaching a new reproducer. You should run it with

  zorba -f -q foo.xq --serialize-text

This uses the "text" serialization method, which should simply dump the in-memory contents of the string to the screen. When run this way, all the entities and character references are gone. But, illegal double-quotes and backslashes remain, as do several illegal control characters (you can see the latter by piping the output through cat -vet). The output also contains newlines inside JSON strings which I'm pretty sure aren't legal. The tab character is gone entirely, but I think that is happening during query parsing; not sure.

So, unless there is something else going on, the output string from json:serialize() is still not guaranteed to be valid JSON. The first thing you should do is put some debug code into the implementation of that function to output the actual return value, to be 100% sure that the on-screen output is in fact exactly the same bytes as the return value. But, assuming that it is, there's a bug.