Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-16 22:50:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 emoji xss fix (#15041)

Browse source
This commit is contained in:
syr1ne 2025-06-16 19:49:15 +05:30 • committed by GitHub
parent 218bbe2000
commit 724cddf7cb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 19 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
kernel/api/system.go
View file

@ -171,9 +171,14 @@ func getEmojiConf(c *gin.Context) {
} }
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := customConfDir + "/" + name
fullPathFilteredName := customConfDir + "/" + util.FilterUploadFileName(name)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("invalid custom emoji name [%s]", name) logging.LogWarnf("invalid custom emoji name [%s]", name)
continue logging.LogErrorf("renaming invalid file to [%s] in emojis", fullPathFilteredName)
if removeErr := os.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
logging.LogErrorf("renaming invalid file to [%s] failed: %s", fullPathFilteredName, removeErr)
}
} }
if customEmoji.IsDir() { if customEmoji.IsDir() {
@ -195,9 +200,14 @@ func getEmojiConf(c *gin.Context) {
} }
if !util.IsValidUploadFileName(html.UnescapeString(name)) { if !util.IsValidUploadFileName(html.UnescapeString(name)) {
emojiFullName := customConfDir + "/" + name
fullPathFilteredName := customConfDir + "/" + util.FilterUploadFileName(name)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("invalid custom emoji name [%s]", name) logging.LogWarnf("invalid custom emoji name [%s]", name)
continue logging.LogErrorf("renaming invalid file to [%s] in emojis", fullPathFilteredName)
if removeErr := os.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
logging.LogErrorf("renaming invalid file to [%s] failed: %s", fullPathFilteredName, removeErr)
}
} }
addCustomEmoji(customEmoji.Name()+"/"+name, &items) addCustomEmoji(customEmoji.Name()+"/"+name, &items)

10
kernel/model/import.go
View file

@ -559,11 +559,13 @@ func ImportSY(zipPath, boxID, toPath string) (err error) {
// 将包含的自定义表情统一移动到 data/emojis/ 下 // 将包含的自定义表情统一移动到 data/emojis/ 下
filelock.Walk(filepath.Join(unzipRootPath, "emojis"), func(path string, d fs.DirEntry, err error) error { filelock.Walk(filepath.Join(unzipRootPath, "emojis"), func(path string, d fs.DirEntry, err error) error {
if !util.IsValidUploadFileName(d.Name()) { if !util.IsValidUploadFileName(d.Name()) {
emojiFullName := unzipRootPath + "emojis/" + name
fullPathFilteredName := unzipRootPath + "emojis/" + util.FilterUploadFileName(name)
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 // XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogErrorf("remove invalid file [%s] in emojis", path) logging.LogWarnf("invalid custom emoji name [%s]", name)
if removeErr := os.Remove(path); nil != removeErr { logging.LogErrorf("renaming invalid file to [%s] in emojis", fullPathFilteredName)
logging.LogErrorf("remove invalid file [%s] failed: %s", path, removeErr) if removeErr := os.Rename(emojiFullName, fullPathFilteredName); nil != removeErr {
return nil logging.LogErrorf("renaming invalid file to [%s] failed: %s", fullPathFilteredName, removeErr)
} }
} }
return nil return nil

1
kernel/util/file.go
View file

@ -207,6 +207,7 @@ func FilterUploadFileName(name string) string {
ret = strings.ReplaceAll(ret, "#", "") ret = strings.ReplaceAll(ret, "#", "")
ret = strings.ReplaceAll(ret, "%", "") ret = strings.ReplaceAll(ret, "%", "")
ret = strings.ReplaceAll(ret, "$", "") ret = strings.ReplaceAll(ret, "$", "")
ret = strings.ReplaceAll(ret, ";", "")
ret = TruncateLenFileName(ret) ret = TruncateLenFileName(ret)
return ret return ret
} }