Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 07:00:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/13658

Browse source
This commit is contained in:
Daniel 2024-12-30 23:09:00 +08:00
parent 562ce58796
commit 77efc5cca4
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kernel/api/system.go
View file

@ -162,7 +162,7 @@ func getEmojiConf(c *gin.Context) {
} else { } else {
for _, customEmoji := range customEmojis { for _, customEmoji := range customEmojis {
name := customEmoji.Name() name := customEmoji.Name()
if strings.HasPrefix(name, ".") { if strings.HasPrefix(name, ".") || strings.Contains(name, "<") {
continue continue
} }
@ -180,7 +180,7 @@ func getEmojiConf(c *gin.Context) {
} }
name = subCustomEmoji.Name() name = subCustomEmoji.Name()
if strings.HasPrefix(name, ".") { if strings.HasPrefix(name, ".") || strings.Contains(name, "<") {
continue continue
} }