RocketChat / RocketChat/EmbeddedChat

Fix: Missing URI Encoding in EmbeddedChatApi.ts GET Requests

Open
#1,192 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
165
Forks
381
Avg merge
1d 2h
Merged PRs (30d)
1

Description

Description:

Right now, EmbeddedChatApi.ts takes your input (like what you type in search) and puts it directly into the website address (URL) without "encoding" it first. When you use special characters like &, #, or even a simple space, the website doesn't understand the address correctly.

Steps to reproduce:
  1. Use the search feature in the React frontend.

  2. Search for a string containing an ampersand (e.g., "Cats & Dogs").

  3. Observe the network request in the browser developer tools. The request will likely be truncated at the & symbol, leading to a search for only "Cats ".

Impact
  1. Functional failures: If a parameter has special characters like spaces, &, or #, the URL can break and the request may fail or return wrong results.

  2. Security risks: Even though this is an internal SDK, putting user-controlled text directly into URLs without encoding is unsafe and can cause unexpected behavior.

  3. Robustness: The API assumes identifiers (like Room IDs) are always URL-safe, but in some Rocket.Chat setups they might not be.

Locations (eg)
  • getSearchMessages: searchText, roomId
  • getMessages / getOlderMessages: query, field, roomId
  • getUsersInRole: role
  • userData / userInfo: username, userId
  • getThreadMessages: tmid
  • getAllFiles: typeGroup, roomId

Currect

`${this.host}/api/v1/chat.search?roomId=${this.rid}&searchText=${text}`

Code Should be

`${this.host}/api/v1/chat.search?roomId=${encodeURIComponent(this.rid)}&searchText=${encodeURIComponent(text)}`

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in EmbeddedChatApi.ts and inspect the listed GET methods, including getSearchMessages, getMessages, getOlderMessages, getUsersInRole, userData, userInfo, getThreadMessages, and getAllFiles. Check each user-controlled query value and confirm that requests preserve spaces, ampersands, hashes, and other special characters rather than truncating or misreading them.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.