[Copilot]

CodeQL flagged undocumented MD5 usage in Jellyfin controllers and a regex without timeout protection.

Changes

Regex DoS Prevention

• Added TimeSpan.FromSeconds(5) timeout to ConfigurationListCommand.cs regex construction

MD5 Usage Documentation

• Added // lgtm[cs/weak-crypto] suppressions with explanations to 9 Jellyfin API controllers and MelodeeDbContext
• All MD5 instances are non-cryptographic: deterministic GUID generation for Jellyfin API compatibility and HTTP ETag computation

Example:

private static string ComputeEtag(Guid apiKey, Instant lastUpdated)
{
    var input = $"{apiKey:N}-{lastUpdated.ToUnixTimeTicks()}";
    // NOTE: MD5 is used here for generating ETag values for HTTP caching in Jellyfin API compatibility.
    // This is NOT a cryptographic use - ETags are public cache identifiers, not security tokens.
    // lgtm[cs/weak-crypto] MD5 used for non-cryptographic ETag generation, not for security
    var hash = MD5.HashData(Encoding.UTF8.GetBytes(input));
    return Convert.ToHexString(hash).ToLowerInvariant();
}

Documentation

• Updated docs/codeql-fixes.md with complete alert inventory

Files Modified

• 1 CLI command file
• 8 Jellyfin controller files
• 1 database context file
• 1 documentation file

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• itunes.apple.com
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/melodee/melodee/tests/Melodee.Tests.Common/bin/Release/net10.0/Melodee.Tests.Common.runtimeconfig.json --depsfile /home/REDACTED/work/melodee/melodee/tests/Melodee.Tests.Common/bin/Release/net10.0/Melodee.Tests.Common.deps.json /home/REDACTED/work/melodee/melodee/tests/Melodee.Tests.Common/bin/Release/net10.0/testhost.dll --port 42115 --endpoint 127.0.0.1:042115 --role client --parentprocessid 4176 --telemetryoptedin false (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Fix CodeQL Code Scanning Alerts</issue_title>
<issue_description>## Task
Fix all CodeQL code scanning alerts currently reported in the Security tab for this repository.

 ## Instructions

 1. **Review all open code scanning alerts** in the Security → Code scanning alerts section
 2. **Group similar issues** and fix them systematically (e.g., all null reference issues together, all SQL issues together)
 3. **Follow existing code patterns** in the repository when applying fixes
 4. **Do not change functionality** - only address the security/quality issues flagged by CodeQL

 ## Guidelines

 - For C# code, follow the patterns in `.github/instructions/csharp.instructions.md`
 - Use defensive programming (null checks, input validation) where flagged
 - Prefer safe alternatives over suppressing warnings
 - If a warning must be suppressed, add a comment explaining why
 - Run `dotnet build` to ensure fixes compile correctly

 ## Acceptance Criteria

 - [ ] All CodeQL alerts are resolved or have justified suppressions
 - [ ] No new build errors introduced
 - [ ] Changes are minimal and focused only on the flagged issues

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Fix CodeQL Code Scanning Alerts #34

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR addresses CodeQL security alerts by documenting non-cryptographic MD5 usage and adding regex timeout protection. The changes systematically resolve alerts for weak cryptography and potential regex denial-of-service vulnerabilities without altering functionality.

Key Changes:

• Added regex timeout protection to prevent DoS attacks in CLI configuration filtering
• Documented 10 instances of legitimate non-cryptographic MD5 usage across Jellyfin API controllers and database context
• Updated project documentation to track all resolved CodeQL alerts

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Melodee.Cli/Command/ConfigurationListCommand.cs	Added 5-second timeout to regex construction to prevent ReDoS attacks
src/Melodee.Blazor/Controllers/Jellyfin/JellyfinControllerBase.cs	Documented MD5 usage for deterministic server ID generation from instance identifier
src/Melodee.Blazor/Controllers/Jellyfin/ItemsController.cs	Documented MD5 usage for ETag generation in HTTP caching
src/Melodee.Blazor/Controllers/Jellyfin/PlaylistsController.cs	Documented MD5 usage for ETag generation in HTTP caching
src/Melodee.Blazor/Controllers/Jellyfin/MusicGenresController.cs	Documented MD5 usage for genre GUID generation and ETag computation
src/Melodee.Blazor/Controllers/Jellyfin/ArtistsController.cs	Documented MD5 usage for individual and collection ETag generation
src/Melodee.Blazor/Controllers/Jellyfin/UsersController.cs	Documented MD5 usage for ETag generation in HTTP caching
src/Melodee.Blazor/Controllers/Jellyfin/GenresController.cs	Documented MD5 usage for genre GUID generation and ETag computation
src/Melodee.Blazor/Controllers/Jellyfin/UserViewsController.cs	Documented MD5 usage for ETag generation in HTTP caching
src/Melodee.Common/Data/MelodeeDbContext.cs	Documented MD5 usage for deterministic GUID generation in database seed data
docs/codeql-fixes.md	Updated tracking document with complete alert inventory and resolution details

Comments suppressed due to low confidence (6)

src/Melodee.Blazor/Controllers/Jellyfin/JellyfinControllerBase.cs:126

• This foreach loop implicitly filters its target sequence - consider filtering the sequence explicitly using '.Where(...)'.

        foreach (var storedToken in candidateTokens)
        {
            if (JellyfinTokenParser.VerifyToken(tokenInfo.Token, storedToken.TokenSalt, pepper, storedToken.TokenHash))
            {
                if (storedToken.User.IsLocked)
                {
                    JellyfinLogger.LogWarning("JellyfinAuth: User {UserId}:{UserName} is locked",
                        storedToken.User.Id, storedToken.User.UserName);
                    return null;
                }

                JellyfinLogger.LogDebug("JellyfinAuth: Authenticated {UserId}:{UserName} Client={Client}",
                    storedToken.User.Id, storedToken.User.UserName, tokenInfo.Client ?? "unknown");

                HttpContext.Items[UserCacheKey] = storedToken.User;
                _ = UpdateTokenLastUsedAsync(storedToken.Id, now);
                return storedToken.User;
            }
        }

src/Melodee.Blazor/Controllers/Jellyfin/ItemsController.cs:978

• Condition is always false because of ... == ....
  Condition is always false because of ... == ....

        if (library == null || artist == null || album == null)

src/Melodee.Blazor/Controllers/Jellyfin/ItemsController.cs:978

• Condition is always false because of ... == ....

        if (library == null || artist == null || album == null)

src/Melodee.Common/Data/MelodeeDbContext.cs:972

• Redundant call to 'ToString' on a String object.

                        $"{{ 'format': '{TranscodingFormat.Mp3.ToString()}', 'bitrate: 192, 'command': 'ffmpeg -i %s -ss %t -map 0:a:0 -b:a %bk -v 0 -f mp3 -' }}",

src/Melodee.Common/Data/MelodeeDbContext.cs:983

• Redundant call to 'ToString' on a String object.

                        $"{{ 'format': '{TranscodingFormat.Opus.ToString()}', 'bitrate: 128, 'command': 'ffmpeg -i %s -ss %t -map 0:a:0 -b:a %bk -v 0 -c:a libopus -f opus -' }}",

src/Melodee.Common/Data/MelodeeDbContext.cs:994

• Redundant call to 'ToString' on a String object.

                        $"{{ 'format': '{TranscodingFormat.Aac.ToString()}', 'bitrate: 256, 'command': 'ffmpeg -i %s -ss %t -map 0:a:0 -b:a %bk -v 0 -c:a aac -f adts -' }}",

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The date "2025-12-21" appears to be in the past. This should either be corrected to match the actual date of the original fixes or verified if this is intentional documentation of when those fixes were applied.

Suggested change

	1. **Regex DoS Prevention** - Added timeouts to all runtime-constructed Regex instances (2025-12-21, 2026-01-02)
	1. **Regex DoS Prevention** - Added timeouts to all runtime-constructed Regex instances (original fix applied: 2025-12-21; last verified: 2026-01-02)