Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-02-25 16:34:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 Do not execute scripts in assets SVG by default to prevent XSS https://github.com/siyuan-note/siyuan/issues/16844

Browse source 
Signed-off-by: Daniel <845765@qq.com>
This commit is contained in:
Daniel 2026-01-16 18:11:55 +08:00
parent 65532aec99
commit 11115da3d0
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
23 changed files with 125 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
app/src/config/editor.ts
View file

@ -305,6 +305,14 @@ export const editor = {
<textarea class="b3-text-field fn__block" id="katexMacros" spellcheck="false">${window.siyuan.config.editor.katexMacros}</textarea>
</div>
</div>
<label class="fn__flex b3-label">
<div class="fn__flex-1">
${window.siyuan.languages.allowSVGScript}
<div class="b3-label__text">${window.siyuan.languages.allowSVGScriptTip}</div>
</div>
<span class="fn__space"></span>
<input class="b3-switch fn__flex-center" id="allowSVGScript" type="checkbox"${window.siyuan.config.editor.allowSVGScript ? " checked" : ""}/>
</label>
<label class="fn__flex b3-label">
<div class="fn__flex-1">
${window.siyuan.languages.allowHTMLBLockScript}
@ -470,6 +478,7 @@ export const editor = {
inlineStrikethrough: (editor.element.querySelector("#editorMarkdownInlineStrikethrough") as HTMLInputElement).checked,
inlineMark: (editor.element.querySelector("#editorMarkdownInlineMark") as HTMLInputElement).checked
},
allowSVGScript: (editor.element.querySelector("#allowSVGScript") as HTMLInputElement).checked,
allowHTMLBLockScript: (editor.element.querySelector("#allowHTMLBLockScript") as HTMLInputElement).checked,
justify: (editor.element.querySelector("#justify") as HTMLInputElement).checked,
rtl: (editor.element.querySelector("#rtl") as HTMLInputElement).checked,

2
app/src/config/search.ts
View file

@ -28,7 +28,7 @@ export const initConfigSearch = (element: HTMLElement, app: App) => {
"editorMarkdownInlineTag", "editorMarkdownInlineTagTip", "editorMarkdownInlineMath", "editorMarkdownInlineMathTip",
"editorMarkdownInlineStrikethrough", "editorMarkdownInlineStrikethroughTip", "editorMarkdownInlineMark", "editorMarkdownInlineMarkTip",
"allowHTMLBLockScript", "allowHTMLBLockScriptTip", "backlinkExpandTip", "backmentionExpandTip",
"backlinkContainChildren", "backlinkContainChildrenTip"
"backlinkContainChildren", "backlinkContainChildrenTip", "allowSVGScript", "allowSVGScriptTip"
]),
// 文档树

9
app/src/mobile/settings/editor.ts
View file

@ -24,6 +24,7 @@ const setEditor = (modelMainElement: Element) => {
inlineStrikethrough: (modelMainElement.querySelector("#editorMarkdownInlineStrikethrough") as HTMLInputElement).checked,
inlineMark: (modelMainElement.querySelector("#editorMarkdownInlineMark") as HTMLInputElement).checked
};
window.siyuan.config.editor.allowSVGScript = (modelMainElement.querySelector("#allowSVGScript") as HTMLInputElement).checked;
window.siyuan.config.editor.allowHTMLBLockScript = (modelMainElement.querySelector("#allowHTMLBLockScript") as HTMLInputElement).checked;
window.siyuan.config.editor.dynamicLoadBlocks = dynamicLoadBlocks;
window.siyuan.config.editor.justify = (modelMainElement.querySelector("#justify") as HTMLInputElement).checked;
@ -279,6 +280,14 @@ export const initEditor = () => {
<textarea class="b3-text-field fn__block" id="katexMacros">${window.siyuan.config.editor.katexMacros}</textarea>
<div class="b3-label__text">${window.siyuan.languages.katexMacrosTip}</div>
</div>
<label class="fn__flex b3-label">
<div class="fn__flex-1">
${window.siyuan.languages.allowSVGScript}
<div class="b3-label__text">${window.siyuan.languages.allowSVGScriptTip}</div>
</div>
<span class="fn__space"></span>
<input class="b3-switch fn__flex-center" id="allowSVGScript" type="checkbox"${window.siyuan.config.editor.allowSVGScript ? " checked" : ""}/>
</label>
<label class="fn__flex b3-label">
<div class="fn__flex-1">
${window.siyuan.languages.allowHTMLBLockScript}

1
app/src/protyle/export/index.ts
View file

@ -509,6 +509,7 @@ ${getIconScript(servePath)}
config: {
appearance: { mode: 0, codeBlockThemeDark: "${window.siyuan.config.appearance.codeBlockThemeDark}", codeBlockThemeLight: "${window.siyuan.config.appearance.codeBlockThemeLight}" },
editor: {
allowSVGScriptTip: ${window.siyuan.config.editor.allowSVGScript},
allowHTMLBLockScript: ${window.siyuan.config.editor.allowHTMLBLockScript},
fontSize: ${window.siyuan.config.editor.fontSize},
codeLineWrap: true,

5
app/src/types/config.d.ts vendored
View file

@ -350,6 +350,11 @@ declare namespace Config {
*/
export interface IEditor {
/**
* Whether to allow to execute javascript in the SVG
*/
allowSVGScript: boolean;
/**
* Whether to allow to execute javascript in the HTML block
*/