owasp-amass/amass · error

unable to parse database URI query parameters: %v

Error message

unable to parse database URI query parameters: %v

What it means

When the database URI contains a query string, loadDatabase parses it with url.ParseQuery to store the parameters as db.Options. Malformed query syntax (e.g. a bare '%' or missing '=') makes ParseQuery fail and this error is returned, wrapping the underlying parse error.

Source

Thrown at config/graphdb.go:146

	db := &Database{
		Primary:  true, // Set as primary, because it wouldn't be there otherwise.
		URL:      dbURI,
		System:   u.Scheme,
		Username: u.User.Username(),
		DBName:   dbName,
		Host:     u.Hostname(), // Hostname without port
		Port:     u.Port(),     // Get port
	}

	password, isSet := u.User.Password()
	if isSet {
		db.Password = password
	}

	if u.RawQuery != "" {
		queryParams, err := url.ParseQuery(u.RawQuery)
		if err != nil {
			return fmt.Errorf("unable to parse database URI query parameters: %v", err)
		}
		db.Options = queryParams.Encode() // Encode url.Values to a string
	}

	if c.GraphDBs == nil {
		c.GraphDBs = make([]*Database, 0)
	}
	c.GraphDBs = append(c.GraphDBs, db)

	return nil
}

// LocalDatabaseSettings returns the Database for the local bolt store.
func (c *Config) LocalDatabaseSettings(dbs []*Database) *Database {
	bolt := &Database{
		System:  "local",
		Primary: true,
		URL:     OutputDirectory(c.Dir),

View on GitHub (pinned to 79299dce87)

Solutions

1. Fix the query string so it is valid form encoding: key=value pairs joined by &, with special characters percent-encoded.
2. Remove the query string entirely if the options are not needed.
3. Test the query portion with url.ParseQuery in a scratch Go snippet to see the exact offending component (the wrapped %v error names it).

Example fix

// before
"database": "neo4j://user:pass@host/db?replicaSet=rs 0&tls=%zz"
// after
"database": "neo4j://user:pass@host/db?replicaSet=rs+0&tls=true"

if i := strings.Index(dbURI, "?"); i >= 0 {
    if _, err := url.ParseQuery(dbURI[i+1:]); err != nil {
        return fmt.Errorf("invalid query params: %w", err)
    }
}

if err := loadDatabase(uri); err != nil {
    var qe *url.EscapeError
    if errors.As(err, &qe) || strings.Contains(err.Error(), "query parameters") {
        return fmt.Errorf("percent-encode query values: %w", err)
    }
}

When it happens

Trigger: A GraphDB URI whose RawQuery is not valid URL-encoded form data, e.g. 'neo4j://user:pass@host/db?flag%zz' or '?a=1&' with a stray invalid escape.

Common situations: Manually appending options to the URI without encoding; pasting a connection string where '?param=value' got truncated or contains unencoded characters like spaces or braces.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• missing scheme in database URI
• missing username in database URI
• missing hostname in database URI
• received insufficient data from the WHOIS server
• no primary database specified in the configuration

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/6cbf84171a5c0f5c. Report an issue: GitHub.