Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-29 21:08:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS in inline-memo https://github.com/siyuan-note/siyuan/issues/15280

Browse source
This commit is contained in:
Daniel 2025-07-12 11:12:47 +08:00
parent 9ae785e6e3
commit 2ea8743fbf
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
app/src/protyle/util/onGet.ts
View file

@ -133,6 +133,20 @@ const setHTML = (options: {
if (protyle.contentElement.classList.contains("fn__none") && protyle.wysiwyg.element.innerHTML !== "") {
return;
}
if (DOMPurify) {
// XSS in inline-memo https://github.com/siyuan-note/siyuan/issues/15280
const parser = new DOMParser();
const doc = parser.parseFromString(options.content, "text/html");
doc.querySelectorAll("[data-inline-memo-content]").forEach(item => {
const content = item.getAttribute("data-inline-memo-content");
if (content) {
item.setAttribute("data-inline-memo-content", DOMPurify.sanitize(content));
}
});
options.content = doc.body.innerHTML;
}
protyle.block.showAll = options.action.includes(Constants.CB_GET_ALL);
const REMOVED_OVER_HEIGHT = protyle.contentElement.clientHeight * 8;
const updateReadonly = typeof options.updateReadonly === "undefined" ? protyle.wysiwyg.element.innerHTML === "" : options.updateReadonly;