Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 15:10:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-16 22:49:07 +08:00
parent e5a634d90c
commit 5fad080fc3
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 17 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

20
kernel/model/import.go
View file

@ -557,10 +557,11 @@ func ImportSY(zipPath, boxID, toPath string) (err error) {
} }
// 将包含的自定义表情统一移动到 data/emojis/ 下 // 将包含的自定义表情统一移动到 data/emojis/ 下
filelock.Walk(filepath.Join(unzipRootPath, "emojis"), func(path string, d fs.DirEntry, err error) error { unzipRootEmojisPath := filepath.Join(unzipRootPath, "emojis")
filelock.Walk(unzipRootEmojisPath, func(path string, d fs.DirEntry, err error) error {
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := filepath.Join(unzipRootPath, "emojis", d.Name()) emojiFullName := filepath.Join(unzipRootEmojisPath, d.Name())
fullPathFilteredName := filepath.Join(unzipRootPath, "emojis", util.FilterUploadFileName(d.Name())) fullPathFilteredName := filepath.Join(unzipRootEmojisPath, util.FilterUploadFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName) logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr { if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
@ -687,6 +688,19 @@ func ImportData(zipPath string) (err error) {
} }
tmpDataPath := filepath.Join(unzipPath, dirs[0].Name()) tmpDataPath := filepath.Join(unzipPath, dirs[0].Name())
tmpDataEmojisPath := filepath.Join(tmpDataPath, "emojis")
filelock.Walk(tmpDataEmojisPath, func(path string, d fs.DirEntry, err error) error {
if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := filepath.Join(tmpDataEmojisPath, d.Name())
fullPathFilteredName := filepath.Join(tmpDataEmojisPath, util.FilterUploadFileName(d.Name()))
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("renaming invalid custom emoji file [%s] to [%s]", d.Name(), fullPathFilteredName)
if removeErr := filelock.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
logging.LogErrorf("renaming invalid custom emoji file to [%s] failed: %s", fullPathFilteredName, removeErr)
}
}
return nil
})
if err = filelock.Copy(tmpDataPath, util.DataDir); err != nil { if err = filelock.Copy(tmpDataPath, util.DataDir); err != nil {
logging.LogErrorf("copy data dir from [%s] to [%s] failed: %s", tmpDataPath, util.DataDir, err) logging.LogErrorf("copy data dir from [%s] to [%s] failed: %s", tmpDataPath, util.DataDir, err)
err = errors.New("copy data failed") err = errors.New("copy data failed")