{"record":{"id":"20c9a2e8b19c2323","repo":"RocketChat/Rocket.Chat","slug":"error-invalid-query","errorCode":"error-invalid-query","errorMessage":"Invalid query parameter provided: \"${params.query}\"","messagePattern":"Invalid query parameter provided: \"(.+?)\"","errorType":"validation","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/lib/parseJsonQuery.ts","lineNumber":124,"sourceCode":"\t\t\tfields = Object.assign(fields, API.v1.limitedUserFieldsToExcludeIfIsPrivilegedUser);\n\t\t} else {\n\t\t\tfields = Object.assign(fields, API.v1.limitedUserFieldsToExclude);\n\t\t}\n\t}\n\n\tlet query: Record<string, any> = {};\n\tif (typeof params?.query === 'string' && isUnsafeQueryParamsAllowed) {\n\t\tapiDeprecationLogger.parameter(route, 'query', '9.0.0', response, messageGenerator);\n\t\ttry {\n\t\t\tquery = ejson.parse(params.query);\n\t\t\tquery = clean(query, pathAllowConf.def);\n\t\t} catch (e) {\n\t\t\tlogger.warn({\n\t\t\t\tmsg: 'Invalid query parameter provided',\n\t\t\t\tquery: params.query,\n\t\t\t\terr: e,\n\t\t\t});\n\t\t\tthrow new Meteor.Error('error-invalid-query', `Invalid query parameter provided: \\\"${params.query}\\\"`, {\n\t\t\t\thelperMethod: 'parseJsonQuery',\n\t\t\t});\n\t\t}\n\t}\n\n\t// Verify the user has permission to query the fields they are\n\tif (typeof query === 'object') {\n\t\tlet nonQueryableFields = Object.keys(API.v1.defaultFieldsToExclude);\n\n\t\tif (isUsersRoute) {\n\t\t\tif (canViewFullOtherUserInfo) {\n\t\t\t\tnonQueryableFields = nonQueryableFields.concat(Object.keys(API.v1.limitedUserFieldsToExcludeIfIsPrivilegedUser));\n\t\t\t} else {\n\t\t\t\tnonQueryableFields = nonQueryableFields.concat(Object.keys(API.v1.limitedUserFieldsToExclude));\n\t\t\t}\n\t\t}\n\n\t\tconst containsQueryFields = queryFields.length > 0;","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/api/lib/parseJsonQuery.ts#L106-L142","documentation":"parseJsonQuery parses the deprecated query param only when ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=TRUE, using ejson.parse followed by clean() against the route allowlist config. If parsing or cleaning throws, the failure is logged and rethrown as Meteor error-invalid-query with the raw param echoed in the message. The query param is deprecated for security reasons (it allowed arbitrary Mongo queries) and logs a deprecation warning targeting removal in 9.0.0.","triggerScenarios":"With the env var TRUE, sending query=not json, query={name:} (trailing colon), unescaped quotes, or values clean() rejects (e.g. keys containing dots into disallowed paths) on any list endpoint.","commonSituations":"Re-enabling legacy client behavior via the escape-hatch env var and hitting EJSON's stricter parsing (no single quotes, no trailing commas); hand-concatenated query strings missing encodeURIComponent; upgrading between versions where the param became gated and old payloads only fail once the env var is switched on.","solutions":["Send valid strict JSON and URL-encode it: query=%7B%22name%22%3A%7B%22%24regex%22%3A%22a%22%7D%7D","Prefer endpoint-specific filter params (e.g. users.list's term/email) over the deprecated query param","Plan migration away from the param before 9.0.0 removes it"],"exampleFix":"// before\nGET /api/v1/channels.list?query={ 'name': { $regex: 'a' } } // single quotes, unencoded\n\n// after\nGET /api/v1/channels.list?query=%7B%22name%22%3A%7B%22%24regex%22%3A%22a%22%7D%7D","handlingStrategy":"validation","validationCode":"function buildQueryParam(query: Record<string, unknown>): string {\n  const json = JSON.stringify(query); // throws client-side on bad structure\n  JSON.parse(json); // round-trip assertion: strict-JSON safe\n  return encodeURIComponent(json);\n}","typeGuard":"const isPlainQueryObject = (v: unknown): v is Record<string, unknown> =>\n  typeof v === 'object' && v !== null && !Array.isArray(v);","tryCatchPattern":"try {\n  await client.get('/api/v1/channels.list', { params: { query } });\n} catch (e: any) {\n  if (e?.response?.data?.errorType === 'error-invalid-query') {\n    throw new ValidationError(`query param is not valid JSON: ${e.response.data.message}`);\n  }\n  throw e;\n}","preventionTips":["Use a JSON library for the query param — no single quotes, no trailing commas (EJSON is strict)","Prefer dedicated filter params per endpoint over the deprecated query param","Plan for 9.0.0 where query/fields params are removed entirely"],"tags":["rest-api","deprecated","query-param","env-var","validation","meteor-error"],"backgroundTag":"query-validation-failed","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-08-21T10:36:37.832Z"}