From be66e39ee5a916d58d8505337175f25308f48437 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 11 Feb 2026 11:23:28 +0000
Subject: [PATCH] security: fix magnet parameter injection and data loss

- Fix magnet parameter injection vulnerability in `js/magnetShared.js` by ensuring all parameter values are decoded during normalization and re-encoded during URI construction.
- Fix a data loss bug in `normalizeMagnetInput` where parameter values containing `=` were truncated due to `split("=", 2)`.
- Consistently decode all magnet parameter values to ensure a clean internal representation.
- Use `encodeURIComponent` in `buildMagnetUri` to safely reconstruct the magnet URI.

Co-authored-by: PR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
---
 js/magnetShared.js | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/js/magnetShared.js b/js/magnetShared.js
index 9dac666c..03c1c4c5 100644
--- a/js/magnetShared.js
+++ b/js/magnetShared.js
@@ -223,19 +223,25 @@ export function normalizeMagnetInput(rawValue) {
 
   const params = [];
   for (const rawParam of rawParams) {
-    const [rawKey, rawVal = ""] = rawParam.split("=", 2);
-    const key = rawKey.trim();
+    const eqIndex = rawParam.indexOf("=");
+    let key, rawVal;
+    if (eqIndex === -1) {
+      key = rawParam;
+      rawVal = "";
+    } else {
+      key = rawParam.slice(0, eqIndex);
+      rawVal = rawParam.slice(eqIndex + 1);
+    }
+
+    key = key.trim();
     if (!key) {
       continue;
     }
-    const lowerKey = key.toLowerCase();
-    let value = rawVal.trim();
-    if (lowerKey === "xt" && value) {
-      const decoded = safeDecodeURIComponentLoose(value);
-      if (decoded && decoded !== value) {
-        value = decoded;
-        didMutate = true;
-      }
+
+    const trimmedRawVal = rawVal.trim();
+    const value = safeDecodeURIComponentLoose(trimmedRawVal);
+    if (value !== trimmedRawVal) {
+      didMutate = true;
     }
     params.push(createParam(key, value));
   }
@@ -253,7 +259,7 @@ export function normalizeMagnetInput(rawValue) {
 
 export function buildMagnetUri(normalizedScheme, params, fragment) {
   const queryString = params
-    .map(({ key, value }) => (value ? `${key}=${value}` : key))
+    .map(({ key, value }) => (value ? `${key}=${encodeURIComponent(value)}` : key))
     .join("&");
   return `${normalizedScheme}${queryString ? `?${queryString}` : ""}${fragment || ""}`;
 }