{"record":{"id":"e47eb43796a8ea26","repo":"Significant-Gravitas/AutoGPT","slug":"invalid-search-query","errorCode":null,"errorMessage":"Invalid search query","messagePattern":"Invalid search query","errorType":"exception","errorClass":"DatabaseError","httpStatus":500,"severity":"warning","filePath":"autogpt_platform/backend/backend/api/features/store/db.py","lineNumber":504,"sourceCode":"        \"Getting store creators: \"\n        f\"featured={featured}, query={search_query}, sorted_by={sorted_by}, page={page}\"\n    )\n\n    # Build where clause with sanitized inputs\n    where = {}\n\n    # Only return creators with approved agents\n    where[\"num_agents\"] = {\"gt\": 0}\n\n    if featured:\n        where[\"is_featured\"] = featured\n\n    # Add search filter if provided, using parameterized queries\n    if search_query:\n        # Sanitize and validate search query by escaping special characters\n        sanitized_query = search_query.strip()\n        if not sanitized_query or len(sanitized_query) > 100:  # Reasonable length limit\n            raise DatabaseError(\"Invalid search query\")\n\n        # Escape special SQL characters\n        sanitized_query = (\n            sanitized_query.replace(\"\\\\\", \"\\\\\\\\\")\n            .replace(\"%\", \"\\\\%\")\n            .replace(\"_\", \"\\\\_\")\n            .replace(\"[\", \"\\\\[\")\n            .replace(\"]\", \"\\\\]\")\n            .replace(\"'\", \"\\\\'\")\n            .replace('\"', '\\\\\"')\n            .replace(\";\", \"\\\\;\")\n            .replace(\"--\", \"\\\\--\")\n            .replace(\"/*\", \"\\\\/*\")\n            .replace(\"*/\", \"\\\\*/\")\n        )\n\n        where[\"OR\"] = [\n            {\"username\": {\"contains\": sanitized_query, \"mode\": \"insensitive\"}},","sourceCodeStart":486,"sourceCodeEnd":522,"githubUrl":"https://github.com/Significant-Gravitas/AutoGPT/blob/9c8bb5550f446ba5d3046b78896578742495b3cf/autogpt_platform/backend/backend/api/features/store/db.py#L486-L522","documentation":"Raised in get_store_creators when a search_query is supplied but is empty after stripping whitespace or longer than 100 characters. Despite being raised as DatabaseError, this is purely input validation on the creators search endpoint — no database call has been made yet. The query is then escaped (%, _, quotes, comment markers) before being used in Prisma 'contains' filters.","triggerScenarios":"GET /store/creators?search=%20 (whitespace-only), or a search string longer than 100 characters, e.g. a client concatenating user input or pasting a long blob into the search box.","commonSituations":"Frontend search box submitted before debounce/trim; a URL builder appending an untrimmed query param; automated scrapers or fuzzers sending long payloads; copy-paste of text with trailing newlines.","solutions":["Trim the query client-side and skip the request when the result is empty.","Enforce a maxlength=100 on the search input element.","If long queries are legitimate, chunk or truncate them before sending instead of letting the server reject."],"exampleFix":"// before\nconst res = await fetch(`/store/creators?search=${raw}`);\n// after\nconst q = raw.trim().slice(0, 100);\nif (q) { const res = await fetch(`/store/creators?search=${encodeURIComponent(q)}`); }","handlingStrategy":"validation","validationCode":"const q = (searchInput ?? '').trim();\nif (q.length === 0 || q.length > 100) {\n  // skip the request or show 'query too long' instead of calling the API\n  return;\n}\nconst res = await fetch(`/store/creators?search=${encodeURIComponent(q)}`);","typeGuard":"function isValidCreatorSearch(q: string | null | undefined): boolean {\n  const s = (q ?? '').trim();\n  return s.length > 0 && s.length <= 100;\n}","tryCatchPattern":null,"preventionTips":["Debounce the search box and trim input before firing requests.","Set maxlength=100 on search inputs.","Skip empty searches entirely rather than sending ?search="],"tags":["validation","search","store","input-sanitization"],"backgroundTag":null,"analyzedSha":"9c8bb5550f446ba5d3046b78896578742495b3cf","analyzedAt":"2026-08-14T17:17:21.957Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}