{"record":{"id":"37b7b10a2e0bbf49","repo":"theonedev/onedev","slug":"malformed-query-37b7b1","errorCode":null,"errorMessage":"Malformed query","messagePattern":"Malformed query","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/pullrequest/PullRequestQuery.java","lineNumber":122,"sourceCode":"\tpublic PullRequestQuery(@Nullable Criteria<PullRequest> criteria) {\n\t\tthis(criteria, new ArrayList<>());\n\t}\n\n\tpublic PullRequestQuery() {\n\t\tthis(null);\n\t}\n\n\tpublic static PullRequestQuery parse(@Nullable Project project, @Nullable String queryString, boolean withCurrentUserCriteria) {\n\t\tif (queryString != null) {\n\t\t\tCharStream is = CharStreams.fromString(queryString);\n\t\t\tPullRequestQueryLexer lexer = new PullRequestQueryLexer(is);\n\t\t\tlexer.removeErrorListeners();\n\t\t\tlexer.addErrorListener(new BaseErrorListener() {\n\n\t\t\t\t@Override\n\t\t\t\tpublic void syntaxError(Recognizer<?, ?> recognizer, Object offendingSymbol, int line,\n\t\t\t\t\t\t\t\t\t\tint charPositionInLine, String msg, RecognitionException e) {\n\t\t\t\t\tthrow new RuntimeException(\"Malformed query\", e);\n\t\t\t\t}\n\n\t\t\t});\n\t\t\tCommonTokenStream tokens = new CommonTokenStream(lexer);\n\t\t\tPullRequestQueryParser parser = new PullRequestQueryParser(tokens);\n\t\t\tparser.removeErrorListeners();\n\t\t\tparser.setErrorHandler(new BailErrorStrategy());\n\t\t\tQueryContext queryContext = parser.query();\n\t\t\tCriteriaContext criteriaContext = queryContext.criteria();\n\t\t\tCriteria<PullRequest> requestCriteria;\n\t\t\tif (criteriaContext != null) {\n\t\t\t\trequestCriteria = new PullRequestQueryBaseVisitor<Criteria<PullRequest>>() {\n\n\t\t\t\t\t@Override\n\t\t\t\t\tpublic Criteria<PullRequest> visitReferenceCriteria(ReferenceCriteriaContext ctx) {\n\t\t\t\t\t\treturn new ReferenceCriteria(null, ctx.getText(), Is);\n\t\t\t\t\t}\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/pullrequest/PullRequestQuery.java#L104-L140","documentation":"PullRequestQuery parsing installs an ANTLR BaseErrorListener on the lexer that converts any lexical/parse error into RuntimeException(\"Malformed query\", e). This means the query string did not conform to OneDev's pull request query grammar (bad token, unclosed quote, unknown operator spelling).","triggerScenarios":"Passing a syntactically invalid pull request query string to PullRequestQuery.parse, e.g. 'to is \"alice (unbalanced quote)', unknown criterion keyword, stray characters, or wrong operator syntax.","commonSituations":"Hand-written query strings in REST calls or saved queries, typos in field names, quotes/special characters not escaped, queries built by string concatenation without validation.","solutions":["Validate/correct the query syntax against OneDev's pull request query grammar (test it in the web UI query editor first).","Escape quotes and special characters in values; balance all quotes and parentheses.","Build queries with the criteria API or copy a working query from the UI instead of hand-writing tokens."],"exampleFix":"// before\nPullRequestQuery.parse(\"to is \\\"alice); // unbalanced quote -> Malformed query\n// after\nPullRequestQuery.parse(\"\\\"to\\\" is \\\"alice\\\"\");","handlingStrategy":"validation","validationCode":"function validateQuery(q) {\n  if (!balancedQuotes(q) || !balancedParens(q)) throw new Error('Malformed query');\n  return q;\n}","typeGuard":"function isWellFormedQuery(q) { return typeof q === 'string' && q.split('\"').length % 2 === 1; }","tryCatchPattern":"try { query = PullRequestQuery.parse(userQuery); } catch (RuntimeException e) { if (e.getMessage().equals(\"Malformed query\")) { showQuerySyntaxHelp(userQuery); } else throw e; }","preventionTips":["Validate queries in the OneDev web query editor before embedding them in code.","Escape quotes and special characters in field values.","Avoid string-concatenated queries; build them from templates or the criteria API.","Catch the parse exception at the API boundary and return a 400 with the offending query text."],"tags":["onedev","query","parser","syntax"],"backgroundTag":"invalid-query-parameter","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}