{"record":{"id":"c24da2cd4d5a9eaf","repo":"badges/shields","slug":"query-not-supported","errorCode":null,"errorMessage":"query not supported","messagePattern":"query not supported","errorType":"validation","errorClass":"InvalidParameter","httpStatus":400,"severity":"error","filePath":"services/dynamic/json-path.js","lineNumber":55,"sourceCode":"    }\n\n    async handle(namedParams, { url, query: pathExpression, prefix, suffix }) {\n      const data = await this.fetch({\n        schema: Joi.any(),\n        url,\n        httpErrors,\n      })\n\n      let values\n      try {\n        values = jp({ json: data, path: pathExpression, eval: false })\n      } catch (e) {\n        const { message } = e\n        if (\n          message.includes('prevented in JSONPath expression') ||\n          e instanceof TypeError\n        ) {\n          throw new InvalidParameter({\n            prettyMessage: 'query not supported',\n          })\n        } else {\n          throw e\n        }\n      }\n\n      if (!values || !values.length) {\n        throw new InvalidResponse({ prettyMessage: 'no result' })\n      }\n\n      return renderDynamicBadge({ value: values, prefix, suffix })\n    }\n  }\n","sourceCodeStart":37,"sourceCodeEnd":70,"githubUrl":"https://github.com/badges/shields/blob/766fd8bc89a90b8534dc573ab72dec30215ab1ec/services/dynamic/json-path.js#L37-L70","documentation":"The JSONPath service wraps query evaluation in try/catch and converts JSONPath engine errors — messages containing 'prevented in JSONPath expression' or any TypeError — into InvalidParameter with prettyMessage 'query not supported'. This shields the service from code-injection-style or syntactically unsafe expressions.","triggerScenarios":"Passing a query parameter containing disallowed constructs (e.g. script/exec-like expressions flagged by jsonpath 'prevented in JSONPath expression') or a query that causes a TypeError during evaluation (e.g. applying array notation to a non-array, accessing properties of undefined mid-path).","commonSituations":"Users copy XPath-style queries into a JSONPath badge; queries like $..[?(@.a.b)] on heterogeneous data where intermediate nodes lack the property; malicious or overly complex expressions rejected by the jsonpath library.","solutions":["Simplify the JSONPath expression and test it against the actual JSON response","Avoid optional-chaining-style paths that traverse missing intermediate keys; restructure the query or point at a deeper root","Check jsonpath library docs for forbidden constructs and remove them","If the data itself is fine, validate the query with the same jsonpath version locally before deploying"],"exampleFix":"// before\nquery=$.store.book[?(@.price.banana>10)]  // TypeError: property of undefined\n// after\nquery=$.store.book[?(@.price>10)]","handlingStrategy":"validation","validationCode":"const jsonpath = require('jsonpath')\nfunction isSupportedQuery(obj, query) {\n  try {\n    jsonpath.query(obj, query)\n    return true\n  } catch (e) {\n    return !(e.message.includes('prevented in JSONPath expression') || e instanceof TypeError)\n  }\n}\n// validate with a sample of the real payload before using the badge","typeGuard":null,"tryCatchPattern":"try {\n  const badge = await getJsonPathBadge({ url, query })\n} catch (e) {\n  if (e.prettyMessage === 'query not supported') {\n    renderErrorBadge('unsupported JSONPath query')\n  } else throw e\n}","preventionTips":["Keep JSONPath expressions simple; avoid filters traversing possibly-missing nested properties","Test queries with the same jsonpath library version the service uses","Never embed script-like constructs in the query","Derive queries from the actual response payload, not from documentation examples"],"tags":["jsonpath","query","invalid-parameter","badge"],"backgroundTag":"jsonpath-query-unsupported","analyzedSha":"766fd8bc89a90b8534dc573ab72dec30215ab1ec","analyzedAt":"2026-08-30T01:40:27.499Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}