java-topology/defects/jellyfin-0001/patch/jellyfin-0001.patch
russell@unturf.com 9335217e94 jellyfin-0001/jellyfin-0002: Jellyfin 5-MOAD scan
jellyfin-0001 (CWE-407): BaseNfoSaver AddCustomTags xmlTagsUsed List.Contains
O(E*T) per NFO save, fix HashSet O(E). 24.6x at T=50,E=200. UNDF-2026-000000952.

jellyfin-0002 (CWE-312): Logged secrets in SessionManager (access token),
SchedulesDirect (auth token), QuickConnectManager (secret). 3 sites. UNDF-2026-000000953.

MOAD-0002 (Intertangle): CLEAN. No god object pattern detected.
MOAD-0003 (Leaked Context): CLEAN. AsyncLocal only for deadlock detection.
MOAD-0005 (Thundering Herd): CLEAN. FastConcurrentLru with GetOrAdd.
2026-03-31 11:46:30 -04:00

30 lines
1.3 KiB
Diff

# UNDF: UNDF-2026-000000952
--- a/MediaBrowser.XbmcMetadata/Savers/BaseNfoSaver.cs
+++ b/MediaBrowser.XbmcMetadata/Savers/BaseNfoSaver.cs
@@ -273,7 +273,7 @@
AddMediaInfo(hasMediaSources, writer);
}
- var tagsUsed = GetTagsUsed(item).ToList();
+ var tagsUsed = new HashSet<string>(GetTagsUsed(item), StringComparer.OrdinalIgnoreCase);
try
{
@@ -964,7 +964,7 @@
return libraryManager.GetPathAfterNetworkSubstitution(image.Path);
}
- private void AddCustomTags(string path, IReadOnlyCollection<string> xmlTagsUsed, XmlWriter writer, ILogger<BaseNfoSaver> logger)
+ private void AddCustomTags(string path, HashSet<string> xmlTagsUsed, XmlWriter writer, ILogger<BaseNfoSaver> logger)
{
var settings = new XmlReaderSettings()
{
@@ -998,7 +998,7 @@
var name = reader.Name;
if (!_commonTags.Contains(name)
- && !xmlTagsUsed.Contains(name, StringComparison.OrdinalIgnoreCase))
+ && !xmlTagsUsed.Contains(name))
{
writer.WriteNode(reader, false);
}