#434

backend/app/controllers/application_controller.rb

@@ -27,6 +27,9 @@ class ApplicationController < ActionController::API
   private
 
   def enforce_query_contract!
+    if request.query_parameters.keys.any? { _1 == 'tag_refs' || _1.start_with?('tag_refs.') }
+      return head :bad_request
+    end
     pairs = URI.decode_www_form(request.query_string)
     return head :bad_request if pairs.length > 1000 || pairs.map(&:first).uniq.length != pairs.length
     return head :bad_request if request.query_parameters.values.any? { !_1.is_a?(String) }