AlistGo/alist · warning

invalid label_id '%s': %v

Error message

invalid label_id '%s': %v

What it means

GetFileByLabel reads the comma-separated label_id query parameter and parses each non-empty token as uint, downcast to uint (32/64-bit platform dependent). Any non-numeric token returns a 400 with 'invalid label_id'.

Source

Thrown at server/handles/label_file_binding.go:154

		page = 1
	}
	pageSize, err := strconv.Atoi(sizeStr)
	if err != nil || pageSize <= 0 || pageSize > 200 {
		pageSize = 50
	}

	fileName := c.Query("file_name")
	labelIDStr := c.Query("label_id")
	var labelIDs []uint
	if labelIDStr != "" {
		parts := strings.Split(labelIDStr, ",")
		for _, p := range parts {
			if p == "" {
				continue
			}
			id64, err := strconv.ParseUint(strings.TrimSpace(p), 10, 64)
			if err != nil {
				common.ErrorResp(c, fmt.Errorf("invalid label_id '%s': %v", p, err), 400)
				return
			}
			labelIDs = append(labelIDs, uint(id64))
		}
	}

	list, total, err := db.ListLabelFileBinDing(userObj.ID, labelIDs, fileName, page, pageSize)
	if err != nil {
		common.ErrorResp(c, err, 500, true)
		return
	}
	common.SuccessResp(c, pageResp[model.LabelFileBinding]{
		Content: list,
		Total:   total,
	})
}

func RestoreLabelFileBinding(c *gin.Context) {

View on GitHub (pinned to 843d9dc814)

Solutions

1. Send only decimal, comma-separated numeric IDs in label_id, e.g. ?label_id=1,2,3
2. Filter/validate tokens client-side before composing the URL
3. On 32-bit deployments, keep label IDs within uint32 range

Example fix

// before
GET /api/label/files?label_id=team,docs

// after
GET /api/label/files?label_id=12,34

for _, p := range strings.Split(labelIDStr, ",") {
    if p == "" { continue }
    if _, err := strconv.ParseUint(strings.TrimSpace(p), 10, 64); err != nil {
        return fmt.Errorf("bad label_id token %q", p)
    }
}

When it happens

Trigger: GET with ?label_id=1,foo, ?label_id=-3, ?label_id=1.5, or IDs exceeding the platform uint range; note 32-bit builds reject IDs above 4294967295.

Common situations: Frontend building the query from user input without filtering; passing label names; passing values from an external system with 64-bit IDs against a 32-bit server.

Related errors

• invalid label ID '%s': %v
• file_name must not empty
• invalid label ID '%s': %v
• can't create RangeReadCloser since URL is empty in link
• missing cookie or qrcode account

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/2a3328f3c37a5b63. Report an issue: GitHub.