Skip to content

Fix: Missing URI Encoding in EmbeddedChatApi.ts GET Requests #1192

@sudorishabh

Description

@sudorishabh

Description:

Right now, EmbeddedChatApi.ts takes your input (like what you type in search) and puts it directly into the website address (URL) without "encoding" it first. When you use special characters like &, #, or even a simple space, the website doesn't understand the address correctly.

Steps to reproduce:

  1. Use the search feature in the React frontend.

  2. Search for a string containing an ampersand (e.g., "Cats & Dogs").

  3. Observe the network request in the browser developer tools. The request will likely be truncated at the & symbol, leading to a search for only "Cats ".

Impact

  1. Functional failures: If a parameter has special characters like spaces, &, or #, the URL can break and the request may fail or return wrong results.

  2. Security risks: Even though this is an internal SDK, putting user-controlled text directly into URLs without encoding is unsafe and can cause unexpected behavior.

  3. Robustness: The API assumes identifiers (like Room IDs) are always URL-safe, but in some Rocket.Chat setups they might not be.

Locations (eg)

  • getSearchMessages: searchText, roomId
  • getMessages / getOlderMessages: query, field, roomId
  • getUsersInRole: role
  • userData / userInfo: username, userId
  • getThreadMessages: tmid
  • getAllFiles: typeGroup, roomId

Currect

`${this.host}/api/v1/chat.search?roomId=${this.rid}&searchText=${text}`

Code Should be

`${this.host}/api/v1/chat.search?roomId=${encodeURIComponent(this.rid)}&searchText=${encodeURIComponent(text)}`

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions