Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-03-12 23:46:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 getDynamicIcon interface XSS vulnerability https://github.com/siyuan-note/siyuan/issues/17166

Browse source 
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pmc9-f5qr-2pcr

Signed-off-by: Daniel <845765@qq.com>
This commit is contained in:
Daniel 2026-03-09 16:38:31 +08:00
parent 9c4b184bef
commit 257aa0ef44
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
kernel/util/misc.go
View file

@ -261,6 +261,12 @@ func SanitizeSVG(svgInput string) string {
for _, a := range c.Attr {
key := strings.ToLower(a.Key)
val := strings.TrimSpace(strings.ToLower(a.Val))
val = strings.Map(func(r rune) rune {
if r == '\t' || r == '\n' || r == '\r' {
return -1 // Remove character
}
return r
}, val)
// 删除事件处理器属性（onload, onerror 等）
if strings.HasPrefix(key, "on") {