Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 07:00:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/issues/15082

Browse source
This commit is contained in:
Daniel 2025-06-19 11:16:45 +08:00
parent ff5875f7d7
commit 289ea3aae0
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 13 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

17
kernel/api/system.go
View file

@ -173,7 +173,8 @@ func getEmojiConf(c *gin.Context) {
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := filepath.Join(customConfDir, name) emojiFullName := filepath.Join(customConfDir, name)
fullPathFilteredName := filepath.Join(customConfDir, util.FilterUploadFileName(name)) name = util.FilterUploadFileName(name)
fullPathFilteredName := filepath.Join(customConfDir, name)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
@ -194,22 +195,22 @@ func getEmojiConf(c *gin.Context) {
continue continue
} }
name = subCustomEmoji.Name() subName := subCustomEmoji.Name()
if strings.HasPrefix(name, ".") { if strings.HasPrefix(subName, ".") {
continue continue
} }
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(subName)) {
emojiFullName := filepath.Join(customConfDir, name) emojiFullName := filepath.Join(customConfDir, name, subName)
fullPathFilteredName := filepath.Join(customConfDir, util.FilterUploadFileName(name)) fullPathFilteredName := filepath.Join(customConfDir, name, util.FilterUploadFileName(subName))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", name, fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", subName, fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
logging.LogErrorf("renaming invalid custom emoji file to [%s] failed: %s", fullPathFilteredName, removeErr) logging.LogErrorf("renaming invalid custom emoji file to [%s] failed: %s", fullPathFilteredName, removeErr)
} }
} }
addCustomEmoji(customEmoji.Name()+"/"+name, &items) addCustomEmoji(name+"/"+subName, &items)
} }
continue continue
} }

8
kernel/model/import.go
View file

@ -582,8 +582,8 @@ func ImportSY(zipPath, boxID, toPath string) (err error) {
return nil return nil
} }
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := filepath.Join(unzipRootEmojisPath, d.Name()) emojiFullName := path
fullPathFilteredName := filepath.Join(unzipRootEmojisPath, util.FilterUploadFileName(d.Name())) fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
@ -731,8 +731,8 @@ func ImportData(zipPath string) (err error) {
return nil return nil
} }
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := filepath.Join(tmpDataEmojisPath, d.Name()) emojiFullName := path
fullPathFilteredName := filepath.Join(tmpDataEmojisPath, util.FilterUploadFileName(d.Name())) fullPathFilteredName := filepath.Join(filepath.Dir(path), util.FilterUploadFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {