Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 15:10:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/13658

Browse source
This commit is contained in:
Daniel 2024-12-30 23:09:00 +08:00
parent 562ce58796
commit 77efc5cca4
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
kernel/api/system.go
View file

@ -162,7 +162,7 @@ func getEmojiConf(c *gin.Context) {
} else {
for _, customEmoji := range customEmojis {
name := customEmoji.Name()
if strings.HasPrefix(name, ".") {
if strings.HasPrefix(name, ".") || strings.Contains(name, "<") {
continue
}
@ -180,7 +180,7 @@ func getEmojiConf(c *gin.Context) {
}
name = subCustomEmoji.Name()
if strings.HasPrefix(name, ".") {
if strings.HasPrefix(name, ".") || strings.Contains(name, "<") {
continue
}