From 6b7ce512eddbcc3f31e1e9778fd0fa32e702f47f Mon Sep 17 00:00:00 2001 From: Duncan Tourolle Date: Thu, 20 Aug 2026 19:59:25 +0200 Subject: [PATCH] fix(online): percent-encode query values and path ids build_get_items_endpoint pasted ParentId, IncludeItemTypes, SortBy and SortOrder straight into the query string while the Genres parameter twenty lines below and the SearchTerm parameter both percent-encode theirs. Encode them the same way, per list element so the commas Jellyfin splits on survive. The per-call ids interpolated into request paths (item, person and playlist ids) get the same treatment; a Jellyfin GUID is unchanged by encoding, so this is consistency, not a behaviour change. self.user_id is left alone throughout, as it is at the endpoint builders already. TRACES: UR-007 | DR-212 | UT-206 --- src-tauri/src/repository/online.rs | 168 +++++++++++++++++++++++++---- 1 file changed, 149 insertions(+), 19 deletions(-) diff --git a/src-tauri/src/repository/online.rs b/src-tauri/src/repository/online.rs index 291242b4..44a557d9 100644 --- a/src-tauri/src/repository/online.rs +++ b/src-tauri/src/repository/online.rs @@ -235,7 +235,11 @@ impl OnlineRepository { item_id: &str, t: f64, ) -> Result, RepoError> { - let endpoint = format!("/Plugins/JRay/Items/{}/jray?t={}", item_id, t); + let endpoint = format!( + "/Plugins/JRay/Items/{}/jray?t={}", + urlencoding::encode(item_id), + t + ); match self.get_json::(&endpoint).await { Ok(context) => Ok(context.actors), // No plugin / no truth data for this item — not an error to the user. @@ -802,7 +806,17 @@ fn build_get_items_endpoint( parent_id: &str, options: Option<&GetItemsOptions>, ) -> String { - let mut endpoint = format!("/Users/{}/Items?ParentId={}", user_id, parent_id); + // Every value below is percent-encoded before it goes into the query + // string, the same way `Genres` and `SearchTerm` already are: these are + // values, not URL syntax, so a space or an `&` in one must not split it + // into another parameter. + // + // TRACES: UR-007 | DR-212 | UT-206 + let mut endpoint = format!( + "/Users/{}/Items?ParentId={}", + user_id, + urlencoding::encode(parent_id) + ); if let Some(opts) = options { if let Some(limit) = opts.limit { @@ -812,13 +826,25 @@ fn build_get_items_endpoint( endpoint.push_str(&format!("&StartIndex={}", start_index)); } if let Some(types) = &opts.include_item_types { - endpoint.push_str(&format!("&IncludeItemTypes={}", types.join(","))); + // Encode each type, not the joined string: the comma is the + // list separator Jellyfin splits on. + let encoded: Vec = types + .iter() + .map(|t| urlencoding::encode(t).into_owned()) + .collect(); + endpoint.push_str(&format!("&IncludeItemTypes={}", encoded.join(","))); } if let Some(sort_by) = &opts.sort_by { - endpoint.push_str(&format!("&SortBy={}", sort_by)); + // SortBy is likewise a comma-delimited list (`hybrid.rs` sends + // "ParentIndexNumber,IndexNumber,SortName"), so encode per field. + let encoded: Vec = sort_by + .split(',') + .map(|field| urlencoding::encode(field).into_owned()) + .collect(); + endpoint.push_str(&format!("&SortBy={}", encoded.join(","))); } if let Some(sort_order) = &opts.sort_order { - endpoint.push_str(&format!("&SortOrder={}", sort_order)); + endpoint.push_str(&format!("&SortOrder={}", urlencoding::encode(sort_order))); } if let Some(recursive) = opts.recursive { endpoint.push_str(&format!("&Recursive={}", recursive)); @@ -1147,7 +1173,7 @@ impl MediaRepository for OnlineRepository { /// /// TRACES: UR-021, UR-035 | IR-016, IR-022, JA-005, JA-009 async fn get_item(&self, item_id: &str) -> Result { - let endpoint = format!("/Users/{}/Items/{}?Fields=BackdropImageTags,ParentBackdropImageTags,People,MediaStreams,MediaSources,PremiereDate,UserData", self.user_id, item_id); + let endpoint = format!("/Users/{}/Items/{}?Fields=BackdropImageTags,ParentBackdropImageTags,People,MediaStreams,MediaSources,PremiereDate,UserData", self.user_id, urlencoding::encode(item_id)); let item: JellyfinItem = self.get_json(&endpoint).await?; let media_item = item.into_media_item(self.user_id.clone()); @@ -1510,7 +1536,7 @@ impl MediaRepository for OnlineRepository { } async fn get_playback_info(&self, item_id: &str) -> Result { - let endpoint = format!("/Items/{}/PlaybackInfo", item_id); + let endpoint = format!("/Items/{}/PlaybackInfo", urlencoding::encode(item_id)); #[derive(Debug, Serialize)] #[serde(rename_all = "PascalCase")] @@ -1939,7 +1965,7 @@ impl MediaRepository for OnlineRepository { live_stream_id: Option, } - let endpoint = format!("/Items/{}/PlaybackInfo", item_id); + let endpoint = format!("/Items/{}/PlaybackInfo", urlencoding::encode(item_id)); let request = OpenLiveStreamRequest { user_id: self.user_id.clone(), auto_open_live_stream: true, @@ -2214,7 +2240,11 @@ impl MediaRepository for OnlineRepository { } async fn mark_favorite(&self, item_id: &str) -> Result<(), RepoError> { - let endpoint = format!("/Users/{}/FavoriteItems/{}", self.user_id, item_id); + let endpoint = format!( + "/Users/{}/FavoriteItems/{}", + self.user_id, + urlencoding::encode(item_id) + ); self.post_json(&endpoint, &serde_json::json!({})).await } @@ -2244,7 +2274,11 @@ impl MediaRepository for OnlineRepository { /// /// TRACES: UR-017 | JA-018, DR-021 async fn unmark_favorite(&self, item_id: &str) -> Result<(), RepoError> { - let endpoint = format!("/Users/{}/FavoriteItems/{}", self.user_id, item_id); + let endpoint = format!( + "/Users/{}/FavoriteItems/{}", + self.user_id, + urlencoding::encode(item_id) + ); let url = format!("{}{}", self.server_url, endpoint); let result = async { @@ -2286,7 +2320,11 @@ impl MediaRepository for OnlineRepository { /// /// TRACES: UR-064 | DR-106, JA-033 async fn clear_watch_history(&self, item_id: &str) -> Result<(), RepoError> { - let endpoint = format!("/Users/{}/PlayedItems/{}", self.user_id, item_id); + let endpoint = format!( + "/Users/{}/PlayedItems/{}", + self.user_id, + urlencoding::encode(item_id) + ); let url = format!("{}{}", self.server_url, endpoint); let result = async { @@ -2327,7 +2365,11 @@ impl MediaRepository for OnlineRepository { /// /// TRACES: UR-025 | DR-131 | JA-035 async fn mark_played(&self, item_id: &str) -> Result<(), RepoError> { - let endpoint = format!("/Users/{}/PlayedItems/{}", self.user_id, item_id); + let endpoint = format!( + "/Users/{}/PlayedItems/{}", + self.user_id, + urlencoding::encode(item_id) + ); let url = format!("{}{}", self.server_url, endpoint); let result = async { @@ -2372,7 +2414,11 @@ impl MediaRepository for OnlineRepository { /// /// TRACES: UR-035, UR-036 | IR-022, JA-030 async fn get_person(&self, person_id: &str) -> Result { - let endpoint = format!("/Users/{}/Items/{}", self.user_id, person_id); + let endpoint = format!( + "/Users/{}/Items/{}", + self.user_id, + urlencoding::encode(person_id) + ); let item: JellyfinItem = self.get_json(&endpoint).await?; Ok(item.into_media_item(self.user_id.clone())) } @@ -2461,7 +2507,7 @@ impl MediaRepository for OnlineRepository { async fn delete_playlist(&self, playlist_id: &str) -> Result<(), RepoError> { info!("[OnlineRepo] Deleting playlist {}", playlist_id); - let endpoint = format!("/Items/{}", playlist_id); + let endpoint = format!("/Items/{}", urlencoding::encode(playlist_id)); let url = format!("{}{}", self.server_url, endpoint); let request = self @@ -2496,7 +2542,7 @@ impl MediaRepository for OnlineRepository { "[OnlineRepo] Renaming playlist {} to '{}'", playlist_id, name ); - let endpoint = format!("/Items/{}", playlist_id); + let endpoint = format!("/Items/{}", urlencoding::encode(playlist_id)); self.post_json(&endpoint, &serde_json::json!({ "Name": name })) .await } @@ -2534,8 +2580,17 @@ impl MediaRepository for OnlineRepository { item_ids.len(), playlist_id ); - let ids_param = item_ids.join(","); - let endpoint = format!("/Playlists/{}/Items?Ids={}", playlist_id, ids_param); + // Encode each id, not the joined string: the comma separates the list. + let ids_param = item_ids + .iter() + .map(|id| urlencoding::encode(id).into_owned()) + .collect::>() + .join(","); + let endpoint = format!( + "/Playlists/{}/Items?Ids={}", + urlencoding::encode(playlist_id), + ids_param + ); self.post_json(&endpoint, &serde_json::json!({})).await } @@ -2549,8 +2604,16 @@ impl MediaRepository for OnlineRepository { entry_ids.len(), playlist_id ); - let ids_param = entry_ids.join(","); - let endpoint = format!("/Playlists/{}/Items?EntryIds={}", playlist_id, ids_param); + let ids_param = entry_ids + .iter() + .map(|id| urlencoding::encode(id).into_owned()) + .collect::>() + .join(","); + let endpoint = format!( + "/Playlists/{}/Items?EntryIds={}", + urlencoding::encode(playlist_id), + ids_param + ); let url = format!("{}{}", self.server_url, endpoint); let request = self @@ -3529,6 +3592,73 @@ mod tests { assert!(!off.contains("Filters=IsFavorite")); } + /// UT-206 — the values this endpoint builder puts in the query string are + /// percent-encoded, like `Genres` and `SearchTerm` already are. + /// + /// Unencoded, a value carrying `&` or `=` splits into an extra query + /// parameter (a parent id containing a space produced a malformed URL + /// outright), so the request the server sees is not the one that was built. + /// + /// TRACES: UR-007 | DR-212 | UT-206 + #[test] + fn test_get_items_endpoint_encodes_query_values() { + let endpoint = build_get_items_endpoint( + "u1", + "lib 1&Filters=IsFavorite", + Some(&GetItemsOptions { + include_item_types: Some(vec!["Movie&x=1".to_string()]), + sort_by: Some("Sort Name".to_string()), + sort_order: Some("Ascending&y=2".to_string()), + ..Default::default() + }), + ); + assert!( + endpoint.contains("ParentId=lib%201%26Filters%3DIsFavorite"), + "{endpoint}" + ); + assert!( + endpoint.contains("&IncludeItemTypes=Movie%26x%3D1"), + "{endpoint}" + ); + assert!(endpoint.contains("&SortBy=Sort%20Name"), "{endpoint}"); + assert!( + endpoint.contains("&SortOrder=Ascending%26y%3D2"), + "{endpoint}" + ); + // Nothing smuggled in as a parameter of its own. + assert!(!endpoint.contains("&Filters=IsFavorite"), "{endpoint}"); + assert!(!endpoint.contains("&x=1"), "{endpoint}"); + assert!(!endpoint.contains("&y=2"), "{endpoint}"); + } + + /// The separators inside a list parameter must survive encoding: Jellyfin + /// splits `SortBy` and `IncludeItemTypes` on commas, and `hybrid.rs` sends + /// "ParentIndexNumber,IndexNumber,SortName" to order episodes. + /// + /// TRACES: UR-007 | DR-212 | UT-206 + #[test] + fn test_get_items_endpoint_keeps_list_separators() { + let endpoint = build_get_items_endpoint( + "u1", + "lib-1", + Some(&GetItemsOptions { + sort_by: Some("ParentIndexNumber,IndexNumber,SortName".to_string()), + include_item_types: Some(vec!["Movie".to_string(), "Series".to_string()]), + ..Default::default() + }), + ); + assert!( + endpoint.contains("&SortBy=ParentIndexNumber,IndexNumber,SortName"), + "{endpoint}" + ); + assert!( + endpoint.contains("&IncludeItemTypes=Movie,Series"), + "{endpoint}" + ); + // A plain GUID parent id is unchanged by encoding. + assert!(endpoint.contains("ParentId=lib-1"), "{endpoint}"); + } + /// A newly-added album must arrive as one entry, not one per track. /// /// Jellyfin's `/Items/Latest` defaults to `GroupItems=false`, which returns