Fix all warnings in Jellyfin.Api (#9003)

Jellyfin.Api/Attributes/AcceptsFileAttribute.cs

@@ -25,6 +25,6 @@ namespace Jellyfin.Api.Attributes
         /// Gets the configured content types.
         /// </summary>
         /// <returns>the configured content types.</returns>
-        public string[] GetContentTypes() => _contentTypes;
+        public string[] ContentTypes => _contentTypes;
     }
 }

Jellyfin.Api/Attributes/ProducesFileAttribute.cs

@@ -25,6 +25,6 @@ namespace Jellyfin.Api.Attributes
         /// Gets the configured content types.
         /// </summary>
         /// <returns>the configured content types.</returns>
-        public string[] GetContentTypes() => _contentTypes;
+        public string[] ContentTypes => _contentTypes;
     }
 }

Jellyfin.Api/BaseJellyfinApiController.cs

@@ -17,24 +17,6 @@ namespace Jellyfin.Api
         JsonDefaults.PascalCaseMediaType)]
     public class BaseJellyfinApiController : ControllerBase
     {
-        /// <summary>
-        /// Create a new <see cref="OkResult{T}"/>.
-        /// </summary>
-        /// <param name="value">The value to return.</param>
-        /// <typeparam name="T">The type to return.</typeparam>
-        /// <returns>The <see cref="ActionResult{T}"/>.</returns>
-        protected ActionResult<IEnumerable<T>> Ok<T>(List<T> value)
-            => new OkResult<IEnumerable<T>>(value);
-
-        /// <summary>
-        /// Create a new <see cref="OkResult{T}"/>.
-        /// </summary>
-        /// <param name="value">The value to return.</param>
-        /// <typeparam name="T">The type to return.</typeparam>
-        /// <returns>The <see cref="ActionResult{T}"/>.</returns>
-        protected ActionResult<IEnumerable<T>> Ok<T>(IReadOnlyList<T> value)
-            => new OkResult<IEnumerable<T>>(value);
-
         /// <summary>
         /// Create a new <see cref="OkResult{T}"/>.
         /// </summary>

Jellyfin.Api/Controllers/ApiKeyController.cs

@@ -36,7 +36,7 @@ namespace Jellyfin.Api.Controllers
         [ProducesResponseType(StatusCodes.Status200OK)]
         public async Task<ActionResult<QueryResult<AuthenticationInfo>>> GetKeys()
         {
-            var keys = await _authenticationManager.GetApiKeys();
+            var keys = await _authenticationManager.GetApiKeys().ConfigureAwait(false);
 
             return new QueryResult<AuthenticationInfo>(keys);
         }

Jellyfin.Api/Controllers/ImageController.cs

@@ -106,8 +106,9 @@ namespace Jellyfin.Api.Controllers
             }
 
             var user = _userManager.GetUserById(userId);
-            await using var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
+            var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
-
+            await using (memoryStream.ConfigureAwait(false))
+            {
                 // Handle image/png; charset=utf-8
                 var mimeType = Request.ContentType?.Split(';').FirstOrDefault();
                 var userDataPath = Path.Combine(_serverConfigurationManager.ApplicationPaths.UserConfigurationDirectoryPath, user.Username);
@@ -125,6 +126,7 @@ namespace Jellyfin.Api.Controllers
 
                 return NoContent();
             }
+        }
 
         /// <summary>
         /// Sets the user image.
@@ -153,8 +155,9 @@ namespace Jellyfin.Api.Controllers
             }
 
             var user = _userManager.GetUserById(userId);
-            await using var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
+            var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
-
+            await using (memoryStream.ConfigureAwait(false))
+            {
                 // Handle image/png; charset=utf-8
                 var mimeType = Request.ContentType?.Split(';').FirstOrDefault();
                 var userDataPath = Path.Combine(_serverConfigurationManager.ApplicationPaths.UserConfigurationDirectoryPath, user.Username);
@@ -172,6 +175,7 @@ namespace Jellyfin.Api.Controllers
 
                 return NoContent();
             }
+        }
 
         /// <summary>
         /// Delete the user's image.
@@ -341,8 +345,9 @@ namespace Jellyfin.Api.Controllers
                 return NotFound();
             }
 
-            await using var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
+            var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
-
+            await using (memoryStream.ConfigureAwait(false))
+            {
                 // Handle image/png; charset=utf-8
                 var mimeType = Request.ContentType?.Split(';').FirstOrDefault();
                 await _providerManager.SaveImage(item, memoryStream, mimeType, imageType, null, CancellationToken.None).ConfigureAwait(false);
@@ -350,6 +355,7 @@ namespace Jellyfin.Api.Controllers
 
                 return NoContent();
             }
+        }
 
         /// <summary>
         /// Set item image.
@@ -377,8 +383,9 @@ namespace Jellyfin.Api.Controllers
                 return NotFound();
             }
 
-            await using var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
+            var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
-
+            await using (memoryStream.ConfigureAwait(false))
+            {
                 // Handle image/png; charset=utf-8
                 var mimeType = Request.ContentType?.Split(';').FirstOrDefault();
                 await _providerManager.SaveImage(item, memoryStream, mimeType, imageType, null, CancellationToken.None).ConfigureAwait(false);
@@ -386,6 +393,7 @@ namespace Jellyfin.Api.Controllers
 
                 return NoContent();
             }
+        }
 
         /// <summary>
         /// Updates the index for an item image.
@@ -1788,8 +1796,9 @@ namespace Jellyfin.Api.Controllers
         [AcceptsImageFile]
         public async Task<ActionResult> UploadCustomSplashscreen()
         {
-            await using var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
+            var memoryStream = await GetMemoryStream(Request.Body).ConfigureAwait(false);
-
+            await using (memoryStream.ConfigureAwait(false))
+            {
                 var mimeType = MediaTypeHeaderValue.Parse(Request.ContentType).MediaType;
 
                 if (!mimeType.HasValue)
@@ -1808,13 +1817,15 @@ namespace Jellyfin.Api.Controllers
                 brandingOptions.SplashscreenLocation = filePath;
                 _serverConfigurationManager.SaveConfiguration("branding", brandingOptions);
 
-            await using (var fs = new FileStream(filePath, FileMode.Create, FileAccess.Write, FileShare.None, IODefaults.FileStreamBufferSize, FileOptions.Asynchronous))
+                var fs = new FileStream(filePath, FileMode.Create, FileAccess.Write, FileShare.None, IODefaults.FileStreamBufferSize, FileOptions.Asynchronous);
+                await using (fs.ConfigureAwait(false))
                 {
                     await memoryStream.CopyToAsync(fs, CancellationToken.None).ConfigureAwait(false);
                 }
 
                 return NoContent();
             }
+        }
 
         /// <summary>
         /// Delete a custom splashscreen.

Jellyfin.Api/Controllers/LiveTvController.cs

@@ -1011,10 +1011,9 @@ namespace Jellyfin.Api.Controllers
         {
             if (!string.IsNullOrEmpty(pw))
             {
-                using var sha = SHA1.Create();
                 // TODO: remove ToLower when Convert.ToHexString supports lowercase
                 // Schedules Direct requires the hex to be lowercase
-                listingsProviderInfo.Password = Convert.ToHexString(sha.ComputeHash(Encoding.UTF8.GetBytes(pw))).ToLowerInvariant();
+                listingsProviderInfo.Password = Convert.ToHexString(SHA1.HashData(Encoding.UTF8.GetBytes(pw))).ToLowerInvariant();
             }
 
             return await _liveTvManager.SaveListingProvider(listingsProviderInfo, validateLogin, validateListings).ConfigureAwait(false);

Jellyfin.Api/Controllers/PackageController.cs

@@ -145,7 +145,7 @@ namespace Jellyfin.Api.Controllers
         [ProducesResponseType(StatusCodes.Status200OK)]
         public ActionResult<IEnumerable<RepositoryInfo>> GetRepositories()
         {
-            return _serverConfigurationManager.Configuration.PluginRepositories;
+            return Ok(_serverConfigurationManager.Configuration.PluginRepositories.AsEnumerable());
         }
 
         /// <summary>
@@ -157,7 +157,7 @@ namespace Jellyfin.Api.Controllers
         [HttpPost("Repositories")]
         [Authorize(Policy = Policies.RequiresElevation)]
         [ProducesResponseType(StatusCodes.Status204NoContent)]
-        public ActionResult SetRepositories([FromBody, Required] List<RepositoryInfo> repositoryInfos)
+        public ActionResult SetRepositories([FromBody, Required] RepositoryInfo[] repositoryInfos)
         {
             _serverConfigurationManager.Configuration.PluginRepositories = repositoryInfos;
             _serverConfigurationManager.SaveConfiguration();

Jellyfin.Api/Controllers/PluginsController.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
+using System.Diagnostics.CodeAnalysis;
 using System.IO;
 using System.Linq;
 using System.Text.Json;
@@ -143,7 +144,7 @@ namespace Jellyfin.Api.Controllers
         public ActionResult UninstallPlugin([FromRoute, Required] Guid pluginId)
         {
             // If no version is given, return the current instance.
-            var plugins = _pluginManager.Plugins.Where(p => p.Id.Equals(pluginId));
+            var plugins = _pluginManager.Plugins.Where(p => p.Id.Equals(pluginId)).ToList();
 
             // Select the un-instanced one first.
             var plugin = plugins.FirstOrDefault(p => p.Instance is null) ?? plugins.OrderBy(p => p.Manifest.Status).FirstOrDefault();

Jellyfin.Api/Controllers/SubtitleController.cs

@@ -236,7 +236,9 @@ namespace Jellyfin.Api.Controllers
 
             if (string.Equals(format, "vtt", StringComparison.OrdinalIgnoreCase) && addVttTimeMap)
             {
-                await using Stream stream = await EncodeSubtitles(itemId.Value, mediaSourceId, index.Value, format, startPositionTicks, endPositionTicks, copyTimestamps).ConfigureAwait(false);
+                Stream stream = await EncodeSubtitles(itemId.Value, mediaSourceId, index.Value, format, startPositionTicks, endPositionTicks, copyTimestamps).ConfigureAwait(false);
+                await using (stream.ConfigureAwait(false))
+                {
                     using var reader = new StreamReader(stream);
 
                     var text = await reader.ReadToEndAsync().ConfigureAwait(false);
@@ -245,6 +247,7 @@ namespace Jellyfin.Api.Controllers
 
                     return File(Encoding.UTF8.GetBytes(text), MimeTypes.GetMimeType("file." + format));
                 }
+            }
 
             return File(
                 await EncodeSubtitles(
@@ -403,7 +406,9 @@ namespace Jellyfin.Api.Controllers
         {
             var video = (Video)_libraryManager.GetItemById(itemId);
             var data = Convert.FromBase64String(body.Data);
-            await using var memoryStream = new MemoryStream(data);
+            var memoryStream = new MemoryStream(data, 0, data.Length, false, true);
+            await using (memoryStream.ConfigureAwait(false))
+            {
                 await _subtitleManager.UploadSubtitle(
                     video,
                     new SubtitleResponse
@@ -417,6 +422,7 @@ namespace Jellyfin.Api.Controllers
 
                 return NoContent();
             }
+        }
 
         /// <summary>
         /// Encodes a subtitle in the specified format.

Jellyfin.Api/Controllers/SyncPlayController.cs

@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
+using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Jellyfin.Api.Constants;
@@ -107,7 +108,7 @@ namespace Jellyfin.Api.Controllers
         {
             var currentSession = await RequestHelpers.GetSession(_sessionManager, _userManager, HttpContext).ConfigureAwait(false);
             var syncPlayRequest = new ListGroupsRequest();
-            return Ok(_syncPlayManager.ListGroups(currentSession, syncPlayRequest));
+            return Ok(_syncPlayManager.ListGroups(currentSession, syncPlayRequest).AsEnumerable());
         }
 
         /// <summary>

Jellyfin.Api/Controllers/SystemController.cs

@@ -216,8 +216,7 @@ namespace Jellyfin.Api.Controllers
         public ActionResult<IEnumerable<WakeOnLanInfo>> GetWakeOnLanInfo()
         {
             var result = _network.GetMacAddresses()
-                .Select(i => new WakeOnLanInfo(i))
+                .Select(i => new WakeOnLanInfo(i));
-                .ToList();
             return Ok(result);
         }
     }

Jellyfin.Api/Controllers/UserLibraryController.cs

@@ -211,7 +211,7 @@ namespace Jellyfin.Api.Controllers
             if (item is IHasTrailers hasTrailers)
             {
                 var trailers = hasTrailers.LocalTrailers;
-                return Ok(_dtoService.GetBaseItemDtos(trailers, dtoOptions, user, item));
+                return Ok(_dtoService.GetBaseItemDtos(trailers, dtoOptions, user, item).AsEnumerable());
             }
 
             return Ok(item.GetExtras()

Jellyfin.Api/Jellyfin.Api.csproj

@@ -12,10 +12,6 @@
     <NoWarn>AD0001</NoWarn>
   </PropertyGroup>
 
-  <PropertyGroup Condition=" '$(Configuration)' == 'Debug' ">
-    <CodeAnalysisTreatWarningsAsErrors>false</CodeAnalysisTreatWarningsAsErrors>
-  </PropertyGroup>
-
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Authorization" Version="7.0.1" />
     <PackageReference Include="Microsoft.Extensions.Http" Version="7.0.0" />

Jellyfin.Api/Models/LiveTvDtos/ChannelMappingOptionsDto.cs

@@ -14,14 +14,12 @@ namespace Jellyfin.Api.Models.LiveTvDtos
         /// <summary>
         /// Gets or sets list of tuner channels.
         /// </summary>
-        [SuppressMessage("Microsoft.Performance", "CA2227:ReadOnlyRemoveSetter", MessageId = "TunerChannels", Justification = "Imported from ServiceStack")]
+        required public IReadOnlyList<TunerChannelMapping> TunerChannels { get; set; }
-        public List<TunerChannelMapping> TunerChannels { get; set; } = null!;
 
         /// <summary>
         /// Gets or sets list of provider channels.
         /// </summary>
-        [SuppressMessage("Microsoft.Performance", "CA2227:ReadOnlyRemoveSetter", MessageId = "ProviderChannels", Justification = "Imported from ServiceStack")]
+        required public IReadOnlyList<NameIdPair> ProviderChannels { get; set; }
-        public List<NameIdPair> ProviderChannels { get; set; } = null!;
 
         /// <summary>
         /// Gets or sets list of mappings.

Jellyfin.Server/Filters/FileRequestFilter.cs

@@ -15,7 +15,7 @@ namespace Jellyfin.Server.Filters
             {
                 if (attribute is AcceptsFileAttribute acceptsFileAttribute)
                 {
-                    operation.RequestBody = GetRequestBody(acceptsFileAttribute.GetContentTypes());
+                    operation.RequestBody = GetRequestBody(acceptsFileAttribute.ContentTypes);
                     break;
                 }
             }

Jellyfin.Server/Filters/FileResponseFilter.cs

@@ -40,7 +40,7 @@ namespace Jellyfin.Server.Filters
                     response.Value.Content.Clear();
 
                     // Add all content-types as file.
-                    foreach (var contentType in producesFileAttribute.GetContentTypes())
+                    foreach (var contentType in producesFileAttribute.ContentTypes)
                     {
                         response.Value.Content.Add(contentType, _openApiMediaType);
                     }

Jellyfin.Server/Migrations/Routines/AddDefaultPluginRepository.cs

@@ -38,7 +38,7 @@ namespace Jellyfin.Server.Migrations.Routines
         /// <inheritdoc/>
         public void Perform()
         {
-            _serverConfigurationManager.Configuration.PluginRepositories.Add(_defaultRepositoryInfo);
+            _serverConfigurationManager.Configuration.PluginRepositories = new[] { _defaultRepositoryInfo };
             _serverConfigurationManager.SaveConfiguration();
         }
     }

Jellyfin.Server/Migrations/Routines/ReaddDefaultPluginRepository.cs

@@ -39,9 +39,9 @@ namespace Jellyfin.Server.Migrations.Routines
         public void Perform()
         {
             // Only add if repository list is empty
-            if (_serverConfigurationManager.Configuration.PluginRepositories.Count == 0)
+            if (_serverConfigurationManager.Configuration.PluginRepositories.Length == 0)
             {
-                _serverConfigurationManager.Configuration.PluginRepositories.Add(_defaultRepositoryInfo);
+                _serverConfigurationManager.Configuration.PluginRepositories = new[] { _defaultRepositoryInfo };
                 _serverConfigurationManager.SaveConfiguration();
             }
         }

MediaBrowser.Model/Configuration/ServerConfiguration.cs

@@ -194,7 +194,7 @@ namespace MediaBrowser.Model.Configuration
 
         public string[] CodecsUsed { get; set; } = Array.Empty<string>();
 
-        public List<RepositoryInfo> PluginRepositories { get; set; } = new List<RepositoryInfo>();
+        public RepositoryInfo[] PluginRepositories { get; set; } = Array.Empty<RepositoryInfo>();
 
         public bool EnableExternalContentInSuggestions { get; set; } = true;
 

jellyfin.ruleset

@@ -138,6 +138,10 @@
     <Rule Id="CA2253" Action="Info" />
     <!-- disable warning CA5394: Do not use insecure randomness -->
     <Rule Id="CA5394" Action="Info" />
+    <!-- error on CA3003: Review code for file path injection vulnerabilities -->
+    <Rule Id="CA3003" Action="Info" />
+    <!-- error on CA3006: Review code for process command injection vulnerabilities -->
+    <Rule Id="CA3006" Action="Info" />
 
     <!-- disable warning CA1054: Change the type of parameter url from string to System.Uri -->
     <Rule Id="CA1054" Action="None" />