RocketChat / RocketChat/EmbeddedChat
Search API does not URL-encode searchText query parameter
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 165
- Forks
- 381
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 1
Description
Description:
The search API request does not URL-encode user-provided searchText before appending it to query params.
In packages/api/src/EmbeddedChatApi.ts (around line 1124), the URL is built with:
...&searchText=${text}
Since text comes from user input (packages/react/src/views/MessageAggregators/SearchMessages.js, line 15), special characters like &, ?, #, % can break or alter query parsing.
Steps to reproduce:
- Open chat and use Search Messages.
- Enter a query containing special characters, e.g.
hello&room?x#tag%. - Trigger search and inspect request/query behavior.
- Observe incorrect parsing or unexpected search results.
Expected behavior:
searchText should be safely encoded (via URLSearchParams or encodeURIComponent) so all user input is treated as data, not query syntax.
Actual behavior:
Raw user input is interpolated directly into the URL query string, which can corrupt query parameters and change request interpretation.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in packages/api/src/EmbeddedChatApi.ts around line 1124, then trace the searchText value from packages/react/src/views/MessageAggregators/SearchMessages.js line 15. Verify the request with characters such as &, ?, #, and %. Done means user input is encoded as one searchText value and no longer changes query parsing or search results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, react
- Domain
- api
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100