[Bug]: Tags with slashes are broken in Photos

[StyXman]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I created a tag that includes a slash /, say "tag/with/slashes". The UI said nothing about it. It shows up fine in the Files -> Tags -> "tag/with/slashes", because the URL has looks like this:

apps/files/tags/3?dir=/3

But if I tag images/photos with it, and then try Photos -> Tags -> "tag/with/slashes", it breaks because the URL becomes this:

apps/photos/tags/tag/with/slashes

Interestingly, if instead I use a backslash \, it works if I follow Photos -> Tags -> "tag\with\backslashes", but:

• the URL shows as apps/photos/tags/tag/with/backslashes (!!!)
• if I copy and paste the URL into a new browser tab, it breaks like with the slash case.

There are probably more corner cases here. I suggest you apply some fuzzing testing here.

Steps to reproduce

1. Create tag with a slash or backslash
2. Try to see photos with that tag
3. Try to copy and paste the resulting URL into a new browser tab.

Expected behavior

Not sure. Either unbreak Photos or do not allow slashes.

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

SQlite

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "dbtype": "sqlite3",
        "version": "32.0.3.2",
        "overwrite.cli.url": "http:\/\/localhost",
        "installed": true,
        "maintenance": false,
        "theme": "",
        "loglevel": 0,
        "app_install_overwrite": [
            "maps"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - app_api: 32.0.0
  - bruteforcesettings: 5.0.0-dev.0
  - calendar: 6.1.3
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.1.2
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - gpxpod: 7.2.4
  - groupfolders: 20.1.6
  - keeweb: 0.6.22
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - maps: 1.6.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.12.4
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - spreed: 22.0.7
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - systemtags: 1.22.0
  - tasks: 0.17.1
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - admin_audit: 1.22.0
  - encryption: 2.20.0
  - files_external: 1.24.0
  - files_markdown: 2.4.1 (installed 2.4.1)
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - holiday_calendars: 0.3.0 (installed 0.3.0)
  - suspicious_login: 10.0.0-dev.0
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0
  - user_ldap: 1.23.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response