Listenarrs/Listenarr 0.2.66

Canary 0.2.66

on GitHub

This PR is a focused security and quality pass. No new features — just making things safer, more reliable, and easier to maintain.

Fixed

• Log injection across the board — Anything user-controlled (file paths, search titles, download IDs, ASINs, URLs) now goes through LogRedaction before hitting the logger. Prevents newline injection attacks that could corrupt or spoof structured log output.
• SSRF in NZB and torrent downloaders — NzbgetAdapter and TorrentFileDownloader now validate outbound URLs via OutboundRequestSecurity.TryValidateExternalHttpUrl before making any request. Every redirect hop is checked too, not just the initial URL. Private/LAN hosts are permitted since user-configured indexers typically run on Docker networks.
• SQL injection in debug schema endpoints — Column and table names in raw PRAGMA/SELECT calls in LibraryController are now double-quoted and validated against a whitelist. Low risk in practice (internal endpoints), but still worth fixing.
• Race condition in LoginRateLimiter — BlockUntil and the failure counter are now protected by a per-entry lock. Previously two concurrent login attempts could both slip through the rate limit window at the same time.
• Raw session token in ClaimsPrincipal — SessionService was emitting the actual session token as a claim, which could leak through middleware or claim-inspection APIs. Removed.
• Column injection in StartupDbNormalizer — Column names resolved at startup are now whitelisted + regex-validated before being dropped into ALTER TABLE SQL.
• Bulk audiobook update wasn't transactional — BulkUpdateAudiobooks looped over audiobooks and saved after each one, so a failure halfway through left a partial update in the database. It's now wrapped in a single transaction; everything commits or nothing does.
• FileMover could delete the original before confirming the copy — Hardlinks and copies now go to a temp file f...

Automated canary build

• Version: 0.2.66
• Commit: ad0134c
• Original PR: #466