RocketChat / RocketChat/Rocket.Chat
[bug]: Custom emoji picker shows no results when 'Allow Unsafe Query Parameters' is disabled
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
This was fixed in commit e4b8178 (fix: custom emoji picker showing no emoji when unsafe query params are enabled #42015) but only for the case when unsafe params are enabled. When Allow Unsafe Query Parameters is explicitly set to disabled (stricter security posture), the emoji picker still returns empty results because the query building logic uses unsafe query params without a fallback path.
Steps to reproduce:
- Admin → General → Set
Allow Unsafe Query Parametersto Disabled - In any message composer, open the emoji picker and switch to "Custom" tab
- Observe: no custom emojis are shown (the list is empty)
Expected behavior:
Custom emojis should be listed regardless of the Allow Unsafe Query Parameters setting.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing commit e4b8178 and tracing the custom emoji picker’s query-building logic from the Custom tab entry point. Reproduce the empty results with Allow Unsafe Query Parameters disabled, then verify that custom emojis are listed with both enabled and disabled settings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100