Search API does not URL-encode searchText query parameter
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- javascript, react
- Domain
- api
Research direction
Start in packages/api/src/EmbeddedChatApi.ts around line 1124, then trace the searchText value from packages/react/src/views/MessageAggregators/SearchMessages.js line 15. Verify the request with characters such as &, ?, #, and %. Done means user input is encoded as one searchText value and no longer changes query parsing or search results.
Written by the indexing model from the issue text.
Description
Description:
The search API request does not URL-encode user-provided searchText before appending it to query params.
In packages/api/src/EmbeddedChatApi.ts (around line 1124), the URL is built with:
...&searchText=${text}
Since text comes from user input (packages/react/src/views/MessageAggregators/SearchMessages.js, line 15), special characters like &, ?, #, % can break or alter query parsing.
Steps to reproduce:
- Open chat and use Search Messages.
- Enter a query containing special characters, e.g.
hello&room?x#tag%. - Trigger search and inspect request/query behavior.
- Observe incorrect parsing or unexpected search results.
Expected behavior:
searchText should be safely encoded (via URLSearchParams or encodeURIComponent) so all user input is treated as data, not query syntax.
Actual behavior:
Raw user input is interpolated directly into the URL query string, which can corrupt query parameters and change request interpretation.
- Dominant language
- JavaScript
- Stars
- 165
- Forks
- 381
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from RocketChat/EmbeddedChat
-
enhancement
Difficulty 1/5 Under an hour Newbie friendliness 84/100
RocketChat/EmbeddedChat#1360 · 1 comment ·
-
Permissions change-detection in useFetchChatData is dead — applyPermissions re-runs on every call Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
RocketChat/EmbeddedChat#1317 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
RocketChat/EmbeddedChat#1315 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
RocketChat/EmbeddedChat#1313 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
RocketChat/EmbeddedChat#1294 ·
All issues in RocketChat/EmbeddedChat
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·