badges/shields · error · InvalidParameter

query not supported

Error message

query not supported

What it means

The JSONPath service wraps query evaluation in try/catch and converts JSONPath engine errors — messages containing 'prevented in JSONPath expression' or any TypeError — into InvalidParameter with prettyMessage 'query not supported'. This shields the service from code-injection-style or syntactically unsafe expressions.

Source

Thrown at services/dynamic/json-path.js:55

    }

    async handle(namedParams, { url, query: pathExpression, prefix, suffix }) {
      const data = await this.fetch({
        schema: Joi.any(),
        url,
        httpErrors,
      })

      let values
      try {
        values = jp({ json: data, path: pathExpression, eval: false })
      } catch (e) {
        const { message } = e
        if (
          message.includes('prevented in JSONPath expression') ||
          e instanceof TypeError
        ) {
          throw new InvalidParameter({
            prettyMessage: 'query not supported',
          })
        } else {
          throw e
        }
      }

      if (!values || !values.length) {
        throw new InvalidResponse({ prettyMessage: 'no result' })
      }

      return renderDynamicBadge({ value: values, prefix, suffix })
    }
  }

View on GitHub (pinned to 766fd8bc89)

Solutions

1. Simplify the JSONPath expression and test it against the actual JSON response
2. Avoid optional-chaining-style paths that traverse missing intermediate keys; restructure the query or point at a deeper root
3. Check jsonpath library docs for forbidden constructs and remove them
4. If the data itself is fine, validate the query with the same jsonpath version locally before deploying

Example fix

// before
query=$.store.book[?(@.price.banana>10)]  // TypeError: property of undefined
// after
query=$.store.book[?(@.price>10)]

const jsonpath = require('jsonpath')
function isSupportedQuery(obj, query) {
  try {
    jsonpath.query(obj, query)
    return true
  } catch (e) {
    return !(e.message.includes('prevented in JSONPath expression') || e instanceof TypeError)
  }
}
// validate with a sample of the real payload before using the badge

try {
  const badge = await getJsonPathBadge({ url, query })
} catch (e) {
  if (e.prettyMessage === 'query not supported') {
    renderErrorBadge('unsupported JSONPath query')
  } else throw e
}

When it happens

Trigger: Passing a query parameter containing disallowed constructs (e.g. script/exec-like expressions flagged by jsonpath 'prevented in JSONPath expression') or a query that causes a TypeError during evaluation (e.g. applying array notation to a non-array, accessing properties of undefined mid-path).

Common situations: Users copy XPath-style queries into a JSONPath badge; queries like $..[?(@.a.b)] on heterogeneous data where intermediate nodes lack the property; malicious or overly complex expressions rejected by the jsonpath library.

Related errors

• no result
• strict ssl is required
• invalid url parameter
• requested origin not authorized
• package not found

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/c24da2cd4d5a9eaf. Report an issue: GitHub.