RocketChat / RocketChat/EmbeddedChat

Search API does not URL-encode searchText query parameter

Open Beginner friendly
#1,149 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
165
Forks
381
Avg merge
1d 2h
Merged PRs (30d)
1

Description

Description:

The search API request does not URL-encode user-provided searchText before appending it to query params.

In packages/api/src/EmbeddedChatApi.ts (around line 1124), the URL is built with:
...&searchText=${text}

Since text comes from user input (packages/react/src/views/MessageAggregators/SearchMessages.js, line 15), special characters like &, ?, #, % can break or alter query parsing.

Steps to reproduce:
  1. Open chat and use Search Messages.
  2. Enter a query containing special characters, e.g. hello&room?x#tag%.
  3. Trigger search and inspect request/query behavior.
  4. Observe incorrect parsing or unexpected search results.
Expected behavior:

searchText should be safely encoded (via URLSearchParams or encodeURIComponent) so all user input is treated as data, not query syntax.

Actual behavior:

Raw user input is interpolated directly into the URL query string, which can corrupt query parameters and change request interpretation.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in packages/api/src/EmbeddedChatApi.ts around line 1124, then trace the searchText value from packages/react/src/views/MessageAggregators/SearchMessages.js line 15. Verify the request with characters such as &, ?, #, and %. Done means user input is encoded as one searchText value and no longer changes query parsing or search results.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, react
Domain
api
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.