starred/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2026-05-04 18:09:12 +03:00
Code Issues 822 Packages Projects Releases 10 Wiki Activity

Creating a tag with a single quote in the name causes SQL crashes #1096

New Issue
Closed
opened 2026-02-06 20:30:27 +03:00 by OVERLORD · 3 comments
OVERLORD commented 2026-02-06 20:30:27 +03:00
Owner
Copy Link

Originally created by @SenorSmartyPants on GitHub (Nov 29, 2019).

Describe the bug

This is a bug as old as time.

To Reproduce

Edit series metadata, add tag "Don't Show"
Edit user, block items with tag, add tag "Don't Show"
watch explosions.

Expected behavior

no crashes

Logs

System (please complete the following information):

  • OS: Docker
  • Browser: Chrome
  • Jellyfin Version: 10.4.1
  • Reverse proxy: no
Originally created by @SenorSmartyPants on GitHub (Nov 29, 2019). **Describe the bug** <!-- A clear and concise description of what the bug is. --> This is a bug as old as time. **To Reproduce** <!-- Steps to reproduce the behavior: --> Edit series metadata, add tag "Don't Show" Edit user, block items with tag, add tag "Don't Show" watch explosions. **Expected behavior** <!-- A clear and concise description of what you expected to happen. --> no crashes **Logs** <!-- Please paste any log errors. --> **System (please complete the following information):** - OS: Docker - Browser: Chrome - Jellyfin Version: 10.4.1 - Reverse proxy: no
OVERLORD added the bugconfirmedsecurity labels 2026-02-06 20:30:27 +03:00
OVERLORD commented 2026-02-06 20:30:30 +03:00
Author
Owner
Copy Link

@dkanada commented on GitHub (Nov 30, 2019):

I added the confirmed label because we need to keep this open until it gets resolved. As mentioned previously, the server should never crash from a client request.

@dkanada commented on GitHub (Nov 30, 2019): I added the confirmed label because we need to keep this open until it gets resolved. As mentioned previously, the server should never crash from a client request.
OVERLORD commented 2026-02-06 20:30:33 +03:00
Author
Owner
Copy Link

@dkanada commented on GitHub (Nov 30, 2019):

Might as well mention that adding devices with names that include special characters will also crash the server.

@dkanada commented on GitHub (Nov 30, 2019): Might as well mention that adding devices with names that include special characters will also crash the server.
OVERLORD commented 2026-02-06 20:30:34 +03:00
Author
Owner
Copy Link

@JustAMan commented on GitHub (Dec 2, 2019):

This is also most likely a security issue as (I guess) it fails due to SQL injection.

@JustAMan commented on GitHub (Dec 2, 2019): This is also most likely a security issue as (I guess) it fails due to SQL injection.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
EFjellyfin.db
area:database
awaiting-feedback
backend
blocked
breaking change: web api
bug
build
ci
confirmed
discussion needed
dotnet future
downstream
duplicate
enhancement
feature
future
github-actions
good first issue
hdr
help wanted
invalid
investigation
librarydb
live-tv
lyrics
media playback
music
needs testing
nuget
performance
platform
pull-request
Mirrored from GitHub Pull Request
 question
regression
release critical
requires-web
roadmap
security
security
stale
support
syncplay
ui & ux
upstream
wontfix
No Label bug confirmed security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/jellyfin#1096
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?