Bug- visible garbage text during playback - cache issue
Posted by frozty
I used Claude to help me fix a bug I was encountering when playing movies though the official Jellyfin desktop client for linux/flatpak. Please review and include in main build if you agree with the findings. ===================================================================== Title: patch-jellyfin-html.sh corrupts injected v3 script via unescaped & in sed replacement Module: Media stack / Jellyfin Version: SparkBox v1.6.333 Environment: Generic NAS, Docker 29.6.1 Summary: The Jellyfin cache-clearing patch (/opt/sparkbox/scripts/patch-jellyfin-html.sh) injects a broken script into index.html. Every && in the injected JS gets corrupted into </head</head, and the corrupted code renders as visible plaintext during playback in the Jellyfin Desktop (Flatpak) client. It fails silently in browsers instead (JS parse error), which is why it wasn't caught there. Root cause: The final injection line uses & as sed's special "insert matched text" character without escaping it in the replacement string: bashdocker exec sb-jellyfin-media sh -c "sed -i 's</head${INJECT}</head' ${INDEX}" $INJECT contains literal && (JS logical AND, e.g. p&&p.Servers&&p.Servers[0]&&p.Servers[0].Id). Sed interprets each unescaped & as "insert the full match" — which was </head — corrupting the script into something like: p</head</headp.Servers</head</headp.Servers[0]</head</headp.Servers[0].Id Fix (tested, working): Escape &, \, and in $INJECT before the sed call: bashESCAPEDINJECT=${INJECT//\\/\\\\} ESCAPEDINJECT=${ESCAPEDINJECT//&/\\&} ESCAPEDINJECT=${ESCAPEDINJECT///\\} docker exec sb-jellyfin-media sh -c "sed -i 's</head${ESCAPEDINJECT}</head' ${INDEX}" Repro steps: Enable the Media module with Jellyfin Run patch-jellyfin-html.sh (or sparkbox up, which calls it via the cmdup post-hook) docker exec sb-jellyfin-media grep -c "</head" /jellyfin/jellyfin-web/index.html → returns 7 instead of 1 Open Jellyfin in the official Jellyfin Desktop Flatpak (org.jellyfin.JellyfinDesktop from Flathub) and start playback — corrupted script text appears as an on-screen banner Impact: Cosmetic/confidence issue (visible garbage text during playback) in affected clients, but also means the actual cache-clearing feature never runs — so the underlying "stuck on wrong server after IP/domain change" bug this patch was meant to fix is silently not working for anyone hitting this. Notes: This will affect every install with the Media module enabled, since the injection is unconditional and the sed bug is deterministic — not environment-specific.
3 replies
tomspark wrote:
Confirmed — great catch. You're right about the unescaped & in sed replacement: I checked the script and every & in the injected snippet gets swapped for the matched text, exactly as you described, and our built-in verification misses it because the marker string survives the corruption. So this hits every install with the media stack, and the cache-clear it was meant to deliver has been silently doing nothing. Really solid writeup, thank you. A fix is in the pipeline — I'll post an update here when it ships.
frozty wrote:
Thanks Tom, love your product and plan on becoming a paid supporter as soon as I can. Your quick response helped seal the deal!
tomspark wrote:
That genuinely made my day — thank you. No rush at all on the supporter side: get everything running smoothly first, and shout here whenever anything acts up. That part's free forever either way.