Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-03-06 21:00:16 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 Do not execute scripts in assets SVG by default to prevent XSS https://github.com/siyuan-note/siyuan/issues/16844

Browse source 
Signed-off-by: Daniel <845765@qq.com>
This commit is contained in:
Daniel 2026-01-16 18:11:55 +08:00
parent 65532aec99
commit 11115da3d0
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
23 changed files with 125 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
app/src/protyle/export/index.ts
View file

@ -509,6 +509,7 @@ ${getIconScript(servePath)}
config: {
appearance: { mode: 0, codeBlockThemeDark: "${window.siyuan.config.appearance.codeBlockThemeDark}", codeBlockThemeLight: "${window.siyuan.config.appearance.codeBlockThemeLight}" },
editor: {
allowSVGScriptTip: ${window.siyuan.config.editor.allowSVGScript},
allowHTMLBLockScript: ${window.siyuan.config.editor.allowHTMLBLockScript},
fontSize: ${window.siyuan.config.editor.fontSize},
codeLineWrap: true,