Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-23 10:00:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-25 13:15:55 +08:00
parent 9718d3b1c8
commit 0a17b83372
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
5 changed files with 11 additions and 38 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kernel/api/block.go
View file

@ -627,10 +627,6 @@ func getBlockInfo(c *gin.Context) {
rootTitle := root.IAL["title"] rootTitle := root.IAL["title"]
rootTitle = html.UnescapeString(rootTitle) rootTitle = html.UnescapeString(rootTitle)
icon := root.IAL["icon"] icon := root.IAL["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadEmojiFileName(icon)
}
ret.Data = map[string]string{ ret.Data = map[string]string{
"box": block.Box, "box": block.Box,
"path": block.Path, "path": block.Path,

9
kernel/filesys/json_parser.go
View file

@ -25,6 +25,7 @@ import (
"github.com/88250/lute/editor" "github.com/88250/lute/editor"
"github.com/88250/lute/parse" "github.com/88250/lute/parse"
"github.com/siyuan-note/siyuan/kernel/treenode" "github.com/siyuan-note/siyuan/kernel/treenode"
"github.com/siyuan-note/siyuan/kernel/util"
) )
func ParseJSONWithoutFix(jsonData []byte, options *parse.Options) (ret *parse.Tree, err error) { func ParseJSONWithoutFix(jsonData []byte, options *parse.Options) (ret *parse.Tree, err error) {
@ -57,6 +58,14 @@ func ParseJSON(jsonData []byte, options *parse.Options) (ret *parse.Tree, needFi
} }
ret = &parse.Tree{Name: "", ID: root.ID, Root: &ast.Node{Type: ast.NodeDocument, ID: root.ID, Spec: root.Spec}, Context: &parse.Context{ParseOption: options}} ret = &parse.Tree{Name: "", ID: root.ID, Root: &ast.Node{Type: ast.NodeDocument, ID: root.ID, Spec: root.Spec}, Context: &parse.Context{ParseOption: options}}
if icon := root.Properties["icon"]; "" != icon {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
if newIcon := util.FilterUploadEmojiFileName(icon); newIcon != icon {
root.Properties["icon"] = newIcon
needFix = true
}
}
ret.Root.KramdownIAL = parse.Map2IAL(root.Properties) ret.Root.KramdownIAL = parse.Map2IAL(root.Properties)
ret.Root.SetIALAttr("type", "doc") ret.Root.SetIALAttr("type", "doc")
for _, kv := range ret.Root.KramdownIAL { for _, kv := range ret.Root.KramdownIAL {

15
kernel/model/blockial.go
View file

@ -250,21 +250,6 @@ func setNodeAttrs0(node *ast.Node, nameValues map[string]string) (oldAttrs map[s
func pushBroadcastAttrTransactions(oldAttrs map[string]string, node *ast.Node) { func pushBroadcastAttrTransactions(oldAttrs map[string]string, node *ast.Node) {
newAttrs := parse.IAL2Map(node.KramdownIAL) newAttrs := parse.IAL2Map(node.KramdownIAL)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
for name, value := range oldAttrs {
if "icon" == name {
value = util.FilterUploadEmojiFileName(value)
oldAttrs[name] = value
}
}
for name, value := range newAttrs {
if "icon" == name {
value = util.FilterUploadEmojiFileName(value)
newAttrs[name] = value
}
}
data := map[string]interface{}{"old": oldAttrs, "new": newAttrs} data := map[string]interface{}{"old": oldAttrs, "new": newAttrs}
if "" != node.AttributeViewType { if "" != node.AttributeViewType {
data["data-av-type"] = node.AttributeViewType data["data-av-type"] = node.AttributeViewType

14
kernel/model/blockinfo.go
View file

@ -65,13 +65,6 @@ func GetDocInfo(blockID string) (ret *BlockInfo) {
title := tree.Root.IALAttr("title") title := tree.Root.IALAttr("title")
ret = &BlockInfo{ID: blockID, RootID: tree.Root.ID, Name: title} ret = &BlockInfo{ID: blockID, RootID: tree.Root.ID, Name: title}
ret.IAL = parse.IAL2Map(tree.Root.KramdownIAL) ret.IAL = parse.IAL2Map(tree.Root.KramdownIAL)
icon := ret.IAL["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadEmojiFileName(icon)
ret.IAL["icon"] = icon
}
scrollData := ret.IAL["scroll"] scrollData := ret.IAL["scroll"]
if 0 < len(scrollData) { if 0 < len(scrollData) {
scroll := map[string]interface{}{} scroll := map[string]interface{}{}
@ -138,12 +131,7 @@ func GetDocInfo(blockID string) (ret *BlockInfo) {
} }
} }
ret.SubFileCount = subFileCount ret.SubFileCount = subFileCount
icon = tree.Root.IALAttr("icon") ret.Icon = tree.Root.IALAttr("icon")
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadEmojiFileName(icon)
}
ret.Icon = icon
return return
} }

7
kernel/model/file.go
View file

@ -80,12 +80,7 @@ func (box *Box) docFromFileInfo(fileInfo *FileInfo, ial map[string]string) (ret
ret.Path = fileInfo.path ret.Path = fileInfo.path
ret.Size = uint64(fileInfo.size) ret.Size = uint64(fileInfo.size)
ret.Name = ial["title"] + ".sy" ret.Name = ial["title"] + ".sy"
icon := ial["icon"] ret.Icon = ial["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadEmojiFileName(icon)
}
ret.Icon = icon
ret.ID = ial["id"] ret.ID = ial["id"]
ret.Name1 = ial["name"] ret.Name1 = ial["name"]
ret.Alias = ial["alias"] ret.Alias = ial["alias"]