From 62e540d60e364ea20c569fdea9e3d71a9e94dbdb Mon Sep 17 00:00:00 2001
From: Georges-Antoine Assi <contact@me.gantoine.com>
Date: Sun, 12 Apr 2026 15:43:14 -0400
Subject: [PATCH] changes from bot review

---
 backend/handler/metadata/libretro_handler.py            | 4 +---
 backend/tests/handler/metadata/test_libretro_handler.py | 2 +-
 backend/utils/generate_supported_platforms.py           | 3 ++-
 frontend/src/components/Details/Title.vue               | 5 +++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/backend/handler/metadata/libretro_handler.py b/backend/handler/metadata/libretro_handler.py
index f7cf363f9..abb9e2cc0 100644
--- a/backend/handler/metadata/libretro_handler.py
+++ b/backend/handler/metadata/libretro_handler.py
@@ -1,12 +1,10 @@
 import hashlib
 import os
 import re
-from sys import platform
 from typing import Final, NotRequired, TypedDict
 
 from adapters.services.libretro_thumbnails import LibretroThumbnailsService
 from adapters.services.libretro_thumbnails_types import LibretroArtType
-from handler.metadata.igdb_handler import IGDB_PLATFORM_LIST
 from logger.logger import log
 
 from .base_handler import MetadataHandler
@@ -42,7 +40,7 @@ def libretro_id_for(filename: str) -> str:
     for the same matched art, fits in the `roms.libretro_id` column (40 chars
     in a varchar(64)).
     """
-    return hashlib.sha1(filename.encode("utf-8")).hexdigest()
+    return hashlib.sha1(filename.encode("utf-8"), usedforsecurity=False).hexdigest()
 
 
 class LibretroHandler(MetadataHandler):
diff --git a/backend/tests/handler/metadata/test_libretro_handler.py b/backend/tests/handler/metadata/test_libretro_handler.py
index 0096eb91d..c9c7df342 100644
--- a/backend/tests/handler/metadata/test_libretro_handler.py
+++ b/backend/tests/handler/metadata/test_libretro_handler.py
@@ -59,7 +59,7 @@ def test_get_platform_supported_platform(handler: LibretroHandler):
 
 
 def test_get_platform_unsupported_platform(handler: LibretroHandler):
-    assert handler.get_platform("not-a-real-platform") is None
+    assert handler.get_platform("not-a-real-platform")["libretro_slug"] is None
 
 
 def test_platform_list_uses_ups_keys():
diff --git a/backend/utils/generate_supported_platforms.py b/backend/utils/generate_supported_platforms.py
index 5b3a1af59..54923646e 100644
--- a/backend/utils/generate_supported_platforms.py
+++ b/backend/utils/generate_supported_platforms.py
@@ -1,5 +1,6 @@
 # uv run python -m utils.generate_supported_platforms
 from typing import TypedDict
+from urllib.parse import quote
 
 from handler.metadata import (
     meta_flashpoint_handler,
@@ -120,7 +121,7 @@ if __name__ == "__main__":
                 else ""
             ),
             (
-                f'<a href="https://thumbnails.libretro.com/{platform["libretro_slug"]}" target="_blank" rel="noopener noreferrer"><img alt="libretro logo" src="../../resources/metadata_providers/libretro.png" height="24px" width="24px"></a>'
+                f'<a href="https://thumbnails.libretro.com/{quote(platform["libretro_slug"], safe="")}" target="_blank" rel="noopener noreferrer"><img alt="libretro logo" src="../../resources/metadata_providers/libretro.png" height="24px" width="24px"></a>'
                 if platform["libretro_slug"]
                 else ""
             ),
diff --git a/frontend/src/components/Details/Title.vue b/frontend/src/components/Details/Title.vue
index 122867637..7c1ff4b75 100644
--- a/frontend/src/components/Details/Title.vue
+++ b/frontend/src/components/Details/Title.vue
@@ -329,10 +329,11 @@ const hashMatches = computed(() => {
           </v-chip>
         </a>
         <a
-          v-if="platform && rom.libretro_id"
+          v-if="platform?.libretro_slug && rom.libretro_id"
           style="text-decoration: none; color: inherit"
-          :href="`https://thumbnails.libretro.com/${platform.libretro_slug}/Named_Boxarts/${rom.fs_name_no_ext}.png`"
+          :href="`https://thumbnails.libretro.com/${encodeURIComponent(platform.libretro_slug)}/Named_Boxarts/${encodeURIComponent(rom.fs_name_no_ext)}.png`"
           target="_blank"
+          rel="noopener noreferrer"
           class="mr-1"
         >
           <v-chip class="px-0 mt-1" size="small" title="Libretro match">