API Escaping Single Quote When Assigned_User Key is Used in Request Body

[sean-sauve]

Debug mode

• I have enabled debug mode
• I have read checked the Common Issues page

Describe the bug

When making a POST request via the API on the hardware endpoint, and a single quote (') is in the name of the asset, this single quote sometimes (but not always) appears as &# 039; in the created asset name. This escaped character does not happen if the request body contains only the keys asset-tag, status_id, model_id, and name. It does happen though if the assigned_user key is in the request body.

Reproduction steps

1. Send a POST request to api/v1/hardware with the name key containing ' in the value of the name, and without the assigned_user key. The asset name will be added to the database with the ' character not escaped.
2. Send a POST request to api/v1/hardware with the name key containing ' in the value of the name, and WITH the assigned_user key. The asset name will be added to the database with the ' character escaped as &# 039;

Expected behavior

Data should be entered into the database as it is submitted to the API.

Screenshots

Snipe-IT Version

v6.0.9 - build 8515

Operating System

ubuntu

Web Server

Apache

PHP Version

PHP 8.1.2

Operating System

N/A: Postman and PowerShell Invoke-WebRequest

Browser

N/A: Postman and PowerShell Invoke-WebRequest

Version

N/A: Postman and PowerShell Invoke-WebRequest

Device

N/A: Postman and PowerShell Invoke-WebRequest

Operating System

N/A: Postman and PowerShell Invoke-WebRequest

Browser

N/A: Postman and PowerShell Invoke-WebRequest

Version

N/A: Postman and PowerShell Invoke-WebRequest

Error messages

No response

Additional context

No response

[welcome]

👋 Thanks for opening your first issue here! If you're reporting a 🐞 bug, please make sure you include steps to reproduce it. We get a lot of issues on this repo, so please be patient and we will get back to you as soon as we can.

[snipe]

The data in the database is likely not escaped - we escape on the way out, to prevent XSS attacks.

[sean-sauve]

I did notice that there is escaped data on the way out during some other calls and have worked around that. Unfortunately, that's not it in this case. In this case the data really is modified in the database; please see below

[sean-sauve]

This is still an issue.