Throw 4xx instead of 5xx for ESQL malformed query params

docs/changelog/134879.yaml

@@ -0,0 +1,6 @@
+pr: 134879
+summary: Throw 4xx instead of 5xx for ESQL malformed query params
+area: ES|QL
+type: bug
+issues:
+ - 134618

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/RequestXContent.java

@@ -220,6 +220,18 @@ private static QueryParams parseParams(XContentParser p) throws IOException {
  }
  }
  }
+ } else {
+ errors.add(
+ new XContentParseException(
+ "Unexpected token ["
+ + token
+ + "] at "
+ + p.getTokenLocation()
+ + ", expected "
+ + XContentParser.Token.START_ARRAY
+ + ". Please check documentation for the correct format of the 'params' field."
+ )
+ );
  }
  // don't allow mixed named and unnamed parameters
  if (namedParams.isEmpty() == false && unNamedParams.isEmpty() == false) {

x-pack/plugin/esql/src/test/java/org/elasticsearch/xpack/esql/action/EsqlQueryRequestTests.java

@@ -408,6 +408,26 @@ public void testInvalidMultivaluedUnnamedParams() throws IOException {
  );
  }
 
+ public void testInvalidParamsString() {
+ String query = randomAlphaOfLengthBetween(1, 100);
+ String json1 = String.format(Locale.ROOT, """
+ {
+ "query": "%s",
+ "params": {*}
+ }""", query);
+ Exception e1 = expectThrows(XContentParseException.class, () -> parseEsqlQueryRequestSync(json1));
+ String message1 = e1.getCause().getMessage();
+ assertThat(message1, containsString("Unexpected token [START_OBJECT]"));
+ String json2 = String.format(Locale.ROOT, """
+ {
+ "query": "%s",
+ "params": "foo"
+ }""", query);
+ Exception e2 = expectThrows(XContentParseException.class, () -> parseEsqlQueryRequestSync(json2));
+ String message2 = e2.getCause().getMessage();
+ assertThat(message2, containsString("Unexpected token [VALUE_STRING]"));
+ }
+
  public void testInvalidParamsForIdentifiersPatterns() throws IOException {
  String query = randomAlphaOfLengthBetween(1, 100);
  boolean columnar = randomBoolean();