Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-23 01:50:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-25 13:15:55 +08:00
parent 9718d3b1c8
commit 0a17b83372
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
5 changed files with 11 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kernel/api/block.go
View file

@ -627,10 +627,6 @@ func getBlockInfo(c *gin.Context) {
rootTitle := root.IAL["title"]
rootTitle = html.UnescapeString(rootTitle)
icon := root.IAL["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadEmojiFileName(icon)
}
ret.Data = map[string]string{
"box": block.Box,
"path": block.Path,