{"record":{"id":"4ba3c944a9a75a27","repo":"theonedev/onedev","slug":"malformed-query-4ba3c9","errorCode":null,"errorMessage":"Malformed query","messagePattern":"Malformed query","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/search/entity/codecomment/CodeCommentQuery.java","lineNumber":98,"sourceCode":"\t\tthis(criteria, new ArrayList<>());\n\t}\n\n\tpublic CodeCommentQuery() {\n\t\tthis(null);\n\t}\n\n\tpublic static CodeCommentQuery parse(Project project, @Nullable String queryString,\n\t\t\t\t\t\t\t\t\t\t boolean withCurrentUserCriteria) {\n\t\tif (queryString != null) {\n\t\t\tCharStream is = CharStreams.fromString(queryString);\n\t\t\tCodeCommentQueryLexer lexer = new CodeCommentQueryLexer(is);\n\t\t\tlexer.removeErrorListeners();\n\t\t\tlexer.addErrorListener(new BaseErrorListener() {\n\n\t\t\t\t@Override\n\t\t\t\tpublic void syntaxError(Recognizer<?, ?> recognizer, Object offendingSymbol, int line,\n\t\t\t\t\t\t\t\t\t\tint charPositionInLine, String msg, RecognitionException e) {\n\t\t\t\t\tthrow new RuntimeException(\"Malformed query\", e);\n\t\t\t\t}\n\n\t\t\t});\n\t\t\tCommonTokenStream tokens = new CommonTokenStream(lexer);\n\t\t\tCodeCommentQueryParser parser = new CodeCommentQueryParser(tokens);\n\t\t\tparser.removeErrorListeners();\n\t\t\tparser.setErrorHandler(new BailErrorStrategy());\n\t\t\tQueryContext queryContext = parser.query();\n\t\t\tCriteriaContext criteriaContext = queryContext.criteria();\n\t\t\tCriteria<CodeComment> commentCriteria;\n\t\t\tif (criteriaContext != null) {\n\t\t\t\tcommentCriteria = new CodeCommentQueryBaseVisitor<Criteria<CodeComment>>() {\n\t\t\t\t\t@Override\n\t\t\t\t\tpublic Criteria<CodeComment> visitFuzzyCriteria(FuzzyCriteriaContext ctx) {\n\t\t\t\t\t\treturn new FuzzyCriteria(getValue(ctx.getText()));\n\t\t\t\t\t}\n\n\t\t\t\t\t@Override","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/search/entity/codecomment/CodeCommentQuery.java#L80-L116","documentation":"CodeCommentQuery.parse() runs the user's query string through an ANTLR lexer/parser for the code-comment query language. Lexer and parser error listeners are replaced with one that throws RuntimeException(\"Malformed query\") on any lexical or syntactic error, so any token/structure that does not match the query grammar aborts parsing. This is how OneDev rejects unparseable code comment search queries.","triggerScenarios":"Calling CodeCommentQuery.parse(project, queryString, withCurrentUserCriteria) with a query string that violates the CodeCommentQuery grammar: unbalanced parentheses, unquoted values containing special characters, invalid operators, stray tokens, or unterminated quoted strings.","commonSituations":"Users typing free-text searches with characters that are grammar-significant (e.g. '~', '(', quotes) without quoting; saved queries or URLs carrying an edited/broken query string; programmatic query builders emitting invalid syntax after a OneDev version changed the grammar.","solutions":["Fix the query string so it conforms to the code comment query grammar (quote values, balance parentheses, use valid operators).","Validate/sanitize user input before passing it to CodeCommentQuery.parse().","Catch RuntimeException (and ExplicitException) around parse() and surface a friendly 'invalid query' message to the user.","Check the OneDev docs for the supported query syntax of the installed version, as grammar rules may differ between releases."],"exampleFix":"// before\nvar query = CodeCommentQuery.parse(project, \"(\" + userInput, true); // unbalanced paren\n// after\nvar sanitized = userInput.trim();\nif (sanitized.chars().filter(c -> c == '(').count() != sanitized.chars().filter(c -> c == ')').count())\n    throw new ExplicitException(\"Unbalanced parentheses in query\");\nvar query = CodeCommentQuery.parse(project, sanitized, true);","handlingStrategy":"try-catch","validationCode":"// basic sanity check before parsing\nstatic boolean balanced(String q) {\n    int depth = 0;\n    boolean inQuote = false;\n    for (char c : q.toCharArray()) {\n        if (c == '\"') inQuote = !inQuote;\n        else if (!inQuote && c == '(') depth++;\n        else if (!inQuote && c == ')') depth--;\n        if (depth < 0) return false;\n    }\n    return depth == 0 && !inQuote;\n}","typeGuard":null,"tryCatchPattern":"try {\n    var query = CodeCommentQuery.parse(project, queryString, true);\n} catch (ExplicitException e) {\n    showUserError(\"Invalid query: \" + e.getMessage());\n} catch (RuntimeException e) {\n    showUserError(\"Malformed query — check syntax (quotes, parentheses, operators)\");\n}","preventionTips":["Use the UI query builder instead of hand-writing query syntax.","Always quote values containing special characters.","Validate the query string in the UI before persisting it as a saved query.","Re-test saved queries after upgrading OneDev, as the grammar can change."],"tags":["query-parser","antlr","search-query","syntax"],"backgroundTag":"invalid-regex-pattern","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}