Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-01-08 01:38:50 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 Some XSS vulnerabilities https://github.com/siyuan-note/siyuan/issues/13171

Browse source
This commit is contained in:
Daniel 2024-11-17 11:34:38 +08:00
parent 74db798a04
commit 096fea2c8f
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
4 changed files with 14 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

2
kernel/model/export.go
View file

@ -3046,7 +3046,7 @@ func getExportBlockRefLinkText(blockRef *ast.Node, blockRefTextLeft, blockRefTex
if "" == linkText {
linkText = sql.GetRefText(defID)
}
linkText = html.UnescapeHTMLStr(linkText) // 块引锚文本导出时 `&` 变为实体 `&` https://github.com/siyuan-note/siyuan/issues/7659
linkText = util.UnescapeHTML(linkText) // 块引锚文本导出时 `&` 变为实体 `&` https://github.com/siyuan-note/siyuan/issues/7659
if Conf.Editor.BlockRefDynamicAnchorTextMaxLen < utf8.RuneCountInString(linkText) {
linkText = gulu.Str.SubStr(linkText, Conf.Editor.BlockRefDynamicAnchorTextMaxLen) + "..."
}