Why is Adobe CQ 5.6.1 changing my JSON output?

[TomMowad]

I have a bug on our site that seems to be related to how CQSE (the Servlet Engine running in Adobe AEM/CQ 5.6.1) outputs something in a JSP.

The use case is just using a .json.jsp to output a JSON object/hash, with some HTML fragments in the JSON values.

Here is an example of a JSP that gives me unexpected results:

<%@include file="/libs/foundation/global.jsp"%><%response.setHeader("Content-Type", "text");%> {"key":"<img src=\"/a/b/c/d/e/f/g/h/i.j.40.40.png\">"}

What I get when I hit the URL on my localhost is:

{"key":"<img src="\">"}

Of course, I tested it in Tomcat to be sure its not some JSP spec thing, and got:

{"key":"<img src=\"/a/b/c/d/e/f/g/h/i.j.40.40.png\">"}

1. What is happening?
2. What can I do to help provide better information for debugging help? What I do know is that our Maven pom.xml's do not specify specific version numbers (which I think is...bad, right?) and so I imagine something has changed in the past 2 weeks (we know that this was working in production as late as January 8, 2015, but even if I use code from several months back, the issue reproduces).

Thanks for any direction, as I'm pretty stuck on this.  (I'm not sure if I should get acquainted with the JSP/Servlet container stack trace, or what?)

[Paul_McMahon]

This is a guess, but perhaps because the content type is set to text instead of application/json the link checker is suppressing the link. Have you tried either using a valid link (one that maps to an actually resource in the repository) or changing the mime type? Total guess but it's the only think I can think of. 

[TomMowad]

Hi orotas,

Good thinking -- it actually happens if the MIME type is either just "text" or "application/json" just the same.  

Also, unfortunately, I saw that the link checker transformer was already set on my localhost to do no link checking or link transforming.  

If you notice, there is are some backslash-quotes (escaped quote) in there -- the first one before the href is what's causing this link to disappear...  (If I remove the quote, it'll print out the string exactly -- but then its no longer valid JSON anymore.)  

--Tom

[TomMowad · Accepted solution]

orotas, your answer was actually spot on.  It was the Sling Rewriter/linkchecker.  What threw me off was that the JSP is still interpreted as a text/html content type if you use response.setHeader("Content-Type", "application/json") -- the correct way to actually do this is to response.setContentType("application/json") instead.