REST API returns every single object on invalid sysparm_query

[Sidney-]

Good day all,

I was hoping someone is able to help me with this question I've ran into.

I'm currently busy converting a PowerShell module we use for a previous CMDB system we use into a ServiceNow version.

I'm using the REST API version 2 for this.

Now one thing I've noticed is that when I enter some bogus text for sysparm_query the API returns all objects from the table.

Since I want to minimize the risk that someone writes a loop and call the API with an incorrect sysparm_query 300 times, I'm trying to understand this behaviour. We can't have the API return every single object 300 times if a user makes a mistake.

I would have expected that if I encode "sakdhsdkjfhsakjfh" into a sysparm query and then query a table, that the API errors out or at least does not return anything because I can assure you that we do not have any objects named "sakdhsdkjfhsakjfh" in our environment.

To be complete here:

This will get me 10 objects (as it's capped in the REST API explorer):

https://<company>.service-now.com/api/now/table/cmdb_ci?sysparm_query=sakdhsdkjfhsakjfh&sysparm_limi...

Someone able to help me here?

Checking the sysparm_query from PowerShell might be doable but challenging I think as there are so many operators possible in a sysparm_query string. 

I've tried the API version 1 also, but it seems to share similar behaviour, the available options for the REST API doesn't really seem to control this behaviour neither.

Thanks in advance for any time invested!

Best regards,

Sidney

[Robin John · Accepted solution]

Hi Sidney,

You can set the glide.invalid_query.returns_no_rows system property to true to have queries with invalid encoded queries return no records.
This property normally works for the GlideRecord class. So I am assuming that the table REST api should also consider this. Could you let me know if this worked for you?

[Sidney-]

Dear Robin,

Thank you for taking the time to reply.

I was just about to close the case again as I was chasing another thing needed sorting out and stumbled across this exact same setting in the FAQ that described the sysparm_query.

I must have read over it a few times.

As for the setting, as this is a system setting, I need to get it approved.

I need to discuss this internally, but I expect it to resolve this.

Have a great day and thanks again!

Best regards,
Sidney