Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-23 01:50:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-16 10:31:04 +08:00
parent e64b486ea4
commit 8fff4b742e
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
3 changed files with 19 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
kernel/api/file.go
View file

@ -380,7 +380,7 @@ func putFile(c *gin.Context) {
return
}
if !isValidFileName(fileAbsPath) { // Improve kernel API `/api/file/putFile` parameter validation https://github.com/siyuan-note/siyuan/issues/14658
if !util.IsValidUploadFileName(filepath.Base(fileAbsPath)) { // Improve kernel API `/api/file/putFile` parameter validation https://github.com/siyuan-note/siyuan/issues/14658
ret.Code = http.StatusBadRequest
ret.Msg = "invalid file path, please check https://github.com/siyuan-note/siyuan/issues/14658 for more details"
return
@ -465,8 +465,3 @@ func millisecond2Time(t int64) time.Time {
msec := t % 1000
return time.Unix(sec, msec*int64(time.Millisecond))
}
func isValidFileName(p string) bool {
name := filepath.Base(p)
return name == util.FilterUploadFileName(name)
}