{"record":{"id":"4ebad5be24e55891","repo":"nextcloud/server","slug":"invalid-input-values","errorCode":null,"errorMessage":"Invalid input values","messagePattern":"Invalid input values","errorType":"http","errorClass":"Sabre\\DAV\\Exception\\BadRequest","httpStatus":400,"severity":"error","filePath":"apps/dav/lib/Comments/CommentsPlugin.php","lineNumber":230,"sourceCode":"\t\t$actorId = null;\n\t\tif ($actorType === 'users') {\n\t\t\t$user = $this->userSession->getUser();\n\t\t\tif (!is_null($user)) {\n\t\t\t\t$actorId = $user->getUID();\n\t\t\t}\n\t\t}\n\t\tif (is_null($actorId)) {\n\t\t\tthrow new BadRequest('Invalid actor \"' . $actorType . '\"');\n\t\t}\n\n\t\ttry {\n\t\t\t$comment = $this->commentsManager->create($actorType, $actorId, $objectType, $objectId);\n\t\t\t$comment->setMessage($data['message']);\n\t\t\t$comment->setVerb($data['verb']);\n\t\t\t$this->commentsManager->save($comment);\n\t\t\treturn $comment;\n\t\t} catch (\\InvalidArgumentException $e) {\n\t\t\tthrow new BadRequest('Invalid input values', 0, $e);\n\t\t} catch (MessageTooLongException $e) {\n\t\t\t$msg = 'Message exceeds allowed character limit of ';\n\t\t\tthrow new BadRequest($msg . IComment::MAX_MESSAGE_LENGTH, 0, $e);\n\t\t}\n\t}\n}\n","sourceCodeStart":212,"sourceCodeEnd":237,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Comments/CommentsPlugin.php#L212-L237","documentation":"The comments manager rejected the creation call: CommentsManager::create() throws InvalidArgumentException for an unknown or empty objectType/objectId (or invalid actor data), and setMessage()/setVerb() throw it for malformed content. The DAV plugin wraps any of these into BadRequest('Invalid input values'), HTTP 400, with the original exception chained as the previous exception.","triggerScenarios":"POST a comment whose objectType is not a registered comments entity (only 'files' unless an app registers more via CommentsEntityEvent), whose objectId is empty or 0, whose verb is missing or invalid, or whose message contains content Comment::setMessage() refuses (e.g. invalid UTF-8 or control characters).","commonSituations":"Typos in objectType ('file' instead of 'files'); forgetting the verb field in the JSON body; clients sending byte strings that decode as JSON but fail UTF-8 validation; objectId sent as 0 after a failed file lookup.","solutions":["Verify objectType is a registered entity type (default: 'files') and objectId is a non-empty id of an existing object.","Include a valid verb ('comment' for file comments) and a clean UTF-8 message in the payload.","Reproduce server-side with ICommentManager::create() on occ, which surfaces the raw InvalidArgumentException message and pinpoints the offending field."],"exampleFix":"// before: HTTP 400 Invalid input values\n$payload = ['actorType' => 'users', 'objectType' => 'file', 'objectId' => '', 'verb' => '', 'message' => $text];\n\n// after: registered type, non-empty id, valid verb\n$payload = ['actorType' => 'users', 'objectType' => 'files', 'objectId' => (string)$fileId, 'verb' => 'comment', 'message' => $text];","handlingStrategy":"validation","validationCode":"$knownTypes = ['files']; // extend with types registered by apps via CommentsEntityEvent\nif (!in_array($payload['objectType'] ?? '', $knownTypes, true)\n    || trim((string)($payload['objectId'] ?? '')) === ''\n    || !isset($payload['verb'], $payload['message'])) {\n    throw new InvalidArgumentException('Comment payload incomplete or objectType unknown');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $client->request('POST', $commentsUrl, $body);\n} catch (ClientHttpException $e) {\n    if ($e->getResponse()->getStatusCode() === 400\n        && str_contains($e->getResponse()->getBody()->getContents(), 'Invalid input values')) {\n        // one of objectType/objectId/verb/message was rejected — log payload fields\n    }\n}","preventionTips":["Keep a client-side list of registered comment entity types and validate against it.","Never send empty objectType, objectId, or verb.","Test payloads against the server-side ICommentManager to get precise field errors."],"tags":["dav","comments","validation","bad-request"],"backgroundTag":"invalid-request-payload","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}