{"record":{"id":"809b1f554d7b31fe","repo":"nextcloud/server","slug":"the-http-nextcloud-com-ns-search-term-has-illeg","errorCode":null,"errorMessage":"The {http://nextcloud.com/ns}search-term has illegal value","messagePattern":"The (.+?)search-term has illegal value","errorType":"http","errorClass":"Sabre\\DAV\\Exception\\BadRequest","httpStatus":400,"severity":"error","filePath":"apps/dav/lib/CalDAV/Search/Xml/Filter/SearchTermFilter.php","lineNumber":28,"sourceCode":"namespace OCA\\DAV\\CalDAV\\Search\\Xml\\Filter;\n\nuse OCA\\DAV\\CalDAV\\Search\\SearchPlugin;\nuse Sabre\\DAV\\Exception\\BadRequest;\nuse Sabre\\Xml\\Reader;\nuse Sabre\\Xml\\XmlDeserializable;\n\nclass SearchTermFilter implements XmlDeserializable {\n\n\t/**\n\t * @param Reader $reader\n\t * @throws BadRequest\n\t * @return string\n\t */\n\t#[\\Override]\n\tpublic static function xmlDeserialize(Reader $reader) {\n\t\t$value = $reader->parseInnerTree();\n\t\tif (!is_string($value)) {\n\t\t\tthrow new BadRequest('The {' . SearchPlugin::NS_Nextcloud . '}search-term has illegal value');\n\t\t}\n\n\t\treturn $value;\n\t}\n}\n","sourceCodeStart":10,"sourceCodeEnd":34,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/CalDAV/Search/Xml/Filter/SearchTermFilter.php#L10-L34","documentation":"Thrown while deserializing {http://nextcloud.com/ns}search-term: SearchTermFilter::xmlDeserialize() requires parseInnerTree() to return a string, and anything else (null from an empty element, or nested XML) triggers Sabre\\DAV\\Exception\\BadRequest (HTTP 400). The element's text content is the substring the server searches for in the filtered properties.","triggerScenarios":"Sending <n:search-term/> with no text, or putting child elements inside it instead of the search text.","commonSituations":"Search UIs submitting an empty query box; empty-string values dropped by an XML writer; whitespace-only content trimmed to null by the parser.","solutions":["Ensure the element contains the query text: <n:search-term>team meeting</n:search-term>","Do not submit the REPORT at all when the user entered no search term","Give the value a default (e.g. empty means match-all is not supported; require >= 1 char)"],"exampleFix":"// before\n<n:search-term/>\n\n// after\n<n:search-term>team meeting</n:search-term>","handlingStrategy":"validation","validationCode":"if (!is_string($term) || trim($term) === '') {\n    // do not send the REPORT without a search term\n    return [];\n}\n$xml = '<n:search-term>' . htmlspecialchars($term, ENT_XML1) . '</n:search-term>';","typeGuard":"function isValidSearchTerm(mixed $term): bool {\n    return is_string($term) && trim($term) !== '';\n}","tryCatchPattern":"try {\n    $client->request('REPORT', $calendarUri, $xmlBody);\n} catch (\\Sabre\\Http\\ClientException $e) {\n    if ($e->getResponse()?->getStatus() === 400) { /* empty search-term: require input */ }\n}","preventionTips":["Disable the search button for empty queries","Trim and reject whitespace-only terms client-side","XML-escape the term text before embedding it"],"tags":["caldav","xml","search","nextcloud","bad-request","search-term"],"backgroundTag":"webdav-400-bad-request","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}