Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-28 20:38:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-17 17:00:29 +08:00
parent 3a991f8075
commit 526e436fbc
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
3 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
kernel/api/setting.go
View file

@ -654,7 +654,12 @@ func setEmoji(c *gin.Context) {
argEmoji := arg["emoji"].([]interface{})
var emoji []string
for _, ae := range argEmoji {
emoji = append(emoji, ae.(string))
e := ae.(string)
if strings.Contains(e, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
e = util.FilterUploadFileName(e)
}
emoji = append(emoji, e)
}
model.Conf.Editor.Emoji = emoji