passbolt/passbolt_api · error · CakeException

" " is not a valid search filter. It should be between 1…

Error message

"{0}" is not a valid search filter. It should be between 1 and 64 char in length.

What it means

Thrown by validateFilterSearch when a keyword passes scalar/UTF-8 checks but its length is outside 1–64 characters, enforced via Validation::lengthBetween. Search terms are capped to keep queries efficient and indexes usable.

Solutions

1. Truncate or split long inputs client-side to 64 chars per keyword before sending
2. Set maxlength=64 on the search input field
3. Server-side, if leniency is desired, pre-trim with mb_substr($keyword, 0, 64) before validating
4. Catch CakeException and return 400 explaining the 1–64 character limit

Example fix

// before
<input type="text" name="search">
// after
<input type="text" name="search" maxlength="64">

$clean = array_map(fn($k) => mb_substr((string)$k, 0, 64), $values);

$isValid = fn($k): bool => is_scalar($k) && mb_strlen((string)$k) >= 1 && mb_strlen((string)$k) <= 64;

try { validateFilterSearch($values); } catch (\Cake\Core\Exception\CakeException $e) { throw new BadRequestException($e->getMessage()); }

When it happens

Trigger: A search keyword longer than 64 chars (or somehow 0 after trimming upstream logic) is validated, e.g. filter[search][0]=<200-char string> from pasted paragraphs.

Common situations: Users pasting sentences/UUIDs-plus-text into search boxes; automated scripts sending whole documents as search terms; UI missing maxlength attribute.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• " " is not a valid search filter.
• " " is not a valid search filter. It is not a UTF8 string.
• " " is not a valid user filter.
• " " is not a valid value for filter .
• Could not validate the password policies settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/e6af2519bc146cfd. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Component/QueryStringComponent.php:460

     * @return bool true if the filter is valid
     */
    public static function validateFilterSearch(array $values): bool
    {
        foreach ($values as $i => $keyword) {
            if (!is_int($i)) {
                throw new CakeException(__('"{0}" is not a valid search filter.', $i));
            }
            if (!is_scalar($keyword) || empty($keyword)) {
                throw new CakeException(__('"{0}" is not a valid search filter.', $i));
            }
            if (!Validation::utf8($keyword)) {
                $msg = __('"{0}" is not a valid search filter. It is not a UTF8 string.', $keyword);
                throw new CakeException($msg);
            }
            if (!Validation::lengthBetween($keyword, 1, 64)) {
                $msg = __('"{0}" is not a valid search filter.', $keyword) . ' ';
                $msg .= __('It should be between 1 and 64 char in length.');
                throw new CakeException($msg);
            }
        }

        return true;
    }

    /**
     * Validate Users Filters
     * Input must be a non-assoc array with utf8 char values between 3 and 64 char in length
     * Examples:
     * - Bueno: [0 => '98c2bef5-cd5f-59e7-a1a7-0107c9a7cf08']
     * - No Bueno: ['this' => 'no']
     *
     * @param array $values array of user id to check
     * @param string $filterName for error message display
     * @throw CakeException if the filter is not valid
     * @return bool true if the filter is valid
     */

View on GitHub (pinned to 31c1bbc10f)