{"record":{"id":"2a3328f3c37a5b63","repo":"AlistGo/alist","slug":"invalid-label-id-s-v-2a3328","errorCode":null,"errorMessage":"invalid label_id '%s': %v","messagePattern":"invalid label_id '(.+?)': (.+?)","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"server/handles/label_file_binding.go","lineNumber":154,"sourceCode":"\t\tpage = 1\n\t}\n\tpageSize, err := strconv.Atoi(sizeStr)\n\tif err != nil || pageSize <= 0 || pageSize > 200 {\n\t\tpageSize = 50\n\t}\n\n\tfileName := c.Query(\"file_name\")\n\tlabelIDStr := c.Query(\"label_id\")\n\tvar labelIDs []uint\n\tif labelIDStr != \"\" {\n\t\tparts := strings.Split(labelIDStr, \",\")\n\t\tfor _, p := range parts {\n\t\t\tif p == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tid64, err := strconv.ParseUint(strings.TrimSpace(p), 10, 64)\n\t\t\tif err != nil {\n\t\t\t\tcommon.ErrorResp(c, fmt.Errorf(\"invalid label_id '%s': %v\", p, err), 400)\n\t\t\t\treturn\n\t\t\t}\n\t\t\tlabelIDs = append(labelIDs, uint(id64))\n\t\t}\n\t}\n\n\tlist, total, err := db.ListLabelFileBinDing(userObj.ID, labelIDs, fileName, page, pageSize)\n\tif err != nil {\n\t\tcommon.ErrorResp(c, err, 500, true)\n\t\treturn\n\t}\n\tcommon.SuccessResp(c, pageResp[model.LabelFileBinding]{\n\t\tContent: list,\n\t\tTotal:   total,\n\t})\n}\n\nfunc RestoreLabelFileBinding(c *gin.Context) {","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/handles/label_file_binding.go#L136-L172","documentation":"GetFileByLabel reads the comma-separated label_id query parameter and parses each non-empty token as uint, downcast to uint (32/64-bit platform dependent). Any non-numeric token returns a 400 with 'invalid label_id'.","triggerScenarios":"GET with ?label_id=1,foo, ?label_id=-3, ?label_id=1.5, or IDs exceeding the platform uint range; note 32-bit builds reject IDs above 4294967295.","commonSituations":"Frontend building the query from user input without filtering; passing label names; passing values from an external system with 64-bit IDs against a 32-bit server.","solutions":["Send only decimal, comma-separated numeric IDs in label_id, e.g. ?label_id=1,2,3","Filter/validate tokens client-side before composing the URL","On 32-bit deployments, keep label IDs within uint32 range"],"exampleFix":"// before\nGET /api/label/files?label_id=team,docs\n\n// after\nGET /api/label/files?label_id=12,34","handlingStrategy":"validation","validationCode":"for _, p := range strings.Split(labelIDStr, \",\") {\n    if p == \"\" { continue }\n    if _, err := strconv.ParseUint(strings.TrimSpace(p), 10, 64); err != nil {\n        return fmt.Errorf(\"bad label_id token %q\", p)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Build the label_id query from numeric IDs only","On 32-bit servers keep IDs within uint32 range","Trim tokens client-side"],"tags":["go","http","validation","labels","query-params"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}