Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-02-14 03:04:21 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-17 17:00:29 +08:00
parent 3a991f8075
commit 526e436fbc
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
3 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
kernel/model/box.go
View file

@ -699,6 +699,11 @@ func ChangeBoxSort(boxIDs []string) {
}
func SetBoxIcon(boxID, icon string) {
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
}
box := &Box{ID: boxID}
boxConf := box.GetConf()
boxConf.Icon = icon

7
kernel/model/conf.go
View file

@ -231,6 +231,13 @@ func InitConf() {
if 1 > len(Conf.Editor.Emoji) {
Conf.Editor.Emoji = []string{}
}
for i, emoji := range Conf.Editor.Emoji {
if strings.Contains(emoji, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
emoji = util.FilterUploadFileName(emoji)
Conf.Editor.Emoji[i] = emoji
}
}
if 9 > Conf.Editor.FontSize || 72 < Conf.Editor.FontSize {
Conf.Editor.FontSize = 16
}