Add trackers to torrent - no validation for special character '|' #15602

New issue

Open

opened 2026-02-22 02:18:05 -05:00 by deekerman · 4 comments

deekerman commented

2026-02-22 02:18:05 -05:00

Owner

Originally created by @1aam2am1 on GitHub (Mar 22, 2024).

qBittorrent & operating system versions

Software versions:
qBittorrent: v4.6.3
qBittorrent Web API: 2.9.3
bitness: 64
boost: 1.82.0
libtorrent: 2.0.10.0
openssl: 3.1.5
qt: 6.6.1
Operating system: docker arm64

What is the problem?

POST /api/v2/torrents/addTrackers HTTP/1.1
Api endpoint doesn't have a validation, and can add a tracker with invalid symbol '|', this creates problem that it is impossible to remove such tracker.

Steps to reproduce

Use addTrackers functionality to add a invalid tracker with '|'
Try using removeTrackers api to remove such tracker. It is impossible as this api have list of trackers separated by '|' which is in tracker name.

Additional context

No response

Log(s) & preferences file(s)

No response

Originally created by @1aam2am1 on GitHub (Mar 22, 2024). ### qBittorrent & operating system versions Software versions: qBittorrent: v4.6.3 qBittorrent Web API: 2.9.3 bitness: 64 boost: 1.82.0 libtorrent: 2.0.10.0 openssl: 3.1.5 qt: 6.6.1 Operating system: docker arm64 ### What is the problem? POST /api/v2/torrents/addTrackers HTTP/1.1 Api endpoint doesn't have a validation, and can add a tracker with invalid symbol '|', this creates problem that it is impossible to remove such tracker. ### Steps to reproduce 1. Use addTrackers functionality to add a invalid tracker with '|' 2. Try using removeTrackers api to remove such tracker. It is impossible as this api have list of trackers separated by '|' which is in tracker name. ### Additional context _No response_ ### Log(s) & preferences file(s) _No response_

deekerman added the

Duplicate

label

2026-02-22 02:18:05 -05:00

deekerman commented

2026-02-22 02:18:10 -05:00

Author

Owner

@glassez commented on GitHub (Mar 23, 2024):

Shouldn't a valid URL really contain | character?

@glassez commented on GitHub (Mar 23, 2024): Shouldn't a valid URL really contain `|` character?

deekerman commented

2026-02-22 02:18:12 -05:00

Author

Owner

@1aam2am1 commented on GitHub (Mar 23, 2024):

It shouldn't have this char, but there is no validation. So it is possible to add a tracker with this character. And it is impossible to remove such tracker as 'removeTrackers' doesn't have escaping character '|' method. And this char is used as tracker separator.

@1aam2am1 commented on GitHub (Mar 23, 2024): It shouldn't have this char, but there is no validation. So it is possible to add a tracker with this character. And it is impossible to remove such tracker as 'removeTrackers' doesn't have escaping character '|' method. And this char is used as tracker separator.

deekerman commented

2026-02-22 02:18:12 -05:00

Author

Owner

@glassez commented on GitHub (Mar 24, 2024):

Duplicate of #19074

@glassez commented on GitHub (Mar 24, 2024): Duplicate of #19074

deekerman commented

2026-02-22 02:18:12 -05:00

Author

Owner

@1aam2am1 commented on GitHub (Mar 24, 2024):

Well, the issue is maybe be duplicate. But we can add fix now. By not changing the api, but the result of adding tracker. We can validate the url to be a valid one. So it shouldn't contain such character. Or only validate for this character. And don't include such trackers/return specified error result is such exists in api.

@1aam2am1 commented on GitHub (Mar 24, 2024): Well, the issue is maybe be duplicate. But we can add fix now. By not changing the api, but the result of adding tracker. We can validate the url to be a valid one. So it shouldn't contain such character. Or only validate for this character. And don't include such trackers/return specified error result is such exists in api.