RocketChat / RocketChat/Rocket.Chat

[Bug]: Custom Emoji Picker broken (invalid query parameter)

Open
#39,834 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triaged type: bug
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Since Version 8.0.0. currently 8.2.1.

When using the Web UI, it sends the following Request to the API to list custom emojis:
https://<URL>/api/v1/emoji-custom.list?query=
This results in the API responding with

{
    "success": false,
    "error": "Invalid query parameter provided: \"\" [error-invalid-query]",
    "errorType": "error-invalid-query",
    "details": {
        "helperMethod": "parseJsonQuery"
    }
}

When I do a cURL to https:///api/v1/emoji-custom.list, it works flawlessly.

Either the UI should omit the query parameter completely, or the backend should change an empty parameter (query=) to {}.

The Emojis are not gone and can still be changed/added/removed from the /admin/emoji panel.

Let me know if there is anything I can do.

Steps to reproduce:
  1. Open Custom Emoji Picker: Will show no emojis.
  2. Check Browser Network Call to https://<URL>/api/v1/emoji-custom.list
Expected behavior:

Custom Emojis work

Actual behavior:
Image Image Image
Server Setup Information:
  • Version of Rocket.Chat Server: 8.2.1
  • License Type: Community
  • Number of Users: 100+
  • Operating System: Container Image
  • Deployment Method: Helm Chart on Kubernetes
  • Number of Running Instances: 1
  • DB Replicaset Oplog: 8.2.3 / unknown (oplog Disabled)
  • NodeJS Version: v22.16.0
  • MongoDB Version: 8.2.3 / unknown (oplog Disabled)
Client Setup Information
  • Desktop App or Browser Version: Same behavior on any browser
  • Operating System: -
Additional context
Relevant logs:
{"level":40,"time":"2026-03-24T09:49:24.036Z","pid":1,"hostname":"rocketchat-rocketchat-66c65d9ff6-xzrfk","name":"DeprecationWarning","section":"API","msg":"The usage of the \"query\" parameter in endpoint \"/api/v1/emoji-custom.list\" breaks the security of the API and can lead to data exposure. It has been deprecated and will be removed in the version 9.0.0.","endpoint":"/api/v1/emoji-custom.list","parameter":"query","version":"9.0.0"}
{"level":40,"time":"2026-03-24T09:49:24.036Z","pid":1,"hostname":"rocketchat-rocketchat-66c65d9ff6-xzrfk","name":"API","msg":"Invalid query parameter provided","query":"","err":{"type":"SyntaxError","message":"Unexpected end of JSON input","stack":"SyntaxError: Unexpected end of JSON input\n    at JSON.parse (<anonymous>)\n    at Object.EJSON.parse (/app/bundle/programs/server/npm/node_modules/ejson/index.js:933:35)\n    at parseJsonQuery (app/api/server/helpers/parseJsonQuery.ts:119:18)\n    at APIClass.parseJsonQuery (app/api/server/ApiClass.ts:248:10)\n    at Object.parseJsonQuery (app/api/server/ApiClass.ts:915:40)\n    at Object.get (app/api/server/v1/emoji-custom.ts:37:33)\n    at Object._internalRouteActionHandler (app/api/server/ApiClass.ts:923:39)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at /app/bundle/programs/server/npm/node_modules/@rocket.chat/http-router/src/Router.ts:256:21\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at app/api/server/middlewares/tracer.ts:20:4\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at app/api/server/middlewares/metrics.ts:22:3\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at app/api/server/middlewares/logger.ts:30:3\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at app/api/server/middlewares/cors.ts:18:4\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at dispatch (/app/bundle/programs/server/npm/node_modules/hono/dist/cjs/compose.js:44:17)\n    at /app/bundle/programs/server/npm/node_modules/hono/dist/cjs/hono-base.js:323:25\n    at /app/bundle/programs/server/npm/node_modules/@rocket.chat/http-router/src/middlewares/honoAdapterForExpress.ts:15:18"}}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with app/api/server/v1/emoji-custom.ts and the parseJsonQuery call shown in app/api/server/helpers/parseJsonQuery.ts, then trace the request from the Custom Emoji Picker. Reproduce the empty query= request and compare it with the working request that omits the parameter. Done means the picker lists custom emojis without triggering the invalid-query error.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.