🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

kernel/api/file.go

@@ -380,7 +380,7 @@ func putFile(c *gin.Context) {
 		return
 	}
 
-	if !isValidFileName(fileAbsPath) { // Improve kernel API `/api/file/putFile` parameter validation https://github.com/siyuan-note/siyuan/issues/14658
+	if !util.IsValidUploadFileName(filepath.Base(fileAbsPath)) { // Improve kernel API `/api/file/putFile` parameter validation https://github.com/siyuan-note/siyuan/issues/14658
 		ret.Code = http.StatusBadRequest
 		ret.Msg = "invalid file path, please check https://github.com/siyuan-note/siyuan/issues/14658 for more details"
 		return
@@ -465,8 +465,3 @@ func millisecond2Time(t int64) time.Time {
 	msec := t % 1000
 	return time.Unix(sec, msec*int64(time.Millisecond))
 }
-
-func isValidFileName(p string) bool {
-	name := filepath.Base(p)
-	return name == util.FilterUploadFileName(name)
-}

kernel/api/system.go

@@ -26,6 +26,7 @@ import (
 
 	"github.com/88250/gulu"
 	"github.com/88250/lute"
+	"github.com/88250/lute/html"
 	"github.com/gin-gonic/gin"
 	"github.com/siyuan-note/logging"
 	"github.com/siyuan-note/siyuan/kernel/conf"
@@ -165,10 +166,15 @@ func getEmojiConf(c *gin.Context) {
 		} else {
 			for _, customEmoji := range customEmojis {
 				name := customEmoji.Name()
-				if strings.HasPrefix(name, ".") || strings.ContainsAny(name, "<\"") {
+				if strings.HasPrefix(name, ".") {
 					continue
 				}
 
+				if !util.IsValidUploadFileName(html.UnescapeString(name)) {
+					// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
+					logging.LogWarnf("invalid custom emoji name [%s]", name)
+				}
+
 				if customEmoji.IsDir() {
 					// 子级
 					subCustomEmojis, err := os.ReadDir(filepath.Join(customConfDir, name))
@@ -183,7 +189,13 @@ func getEmojiConf(c *gin.Context) {
 						}
 
 						name = subCustomEmoji.Name()
-						if strings.HasPrefix(name, ".") || strings.ContainsAny(name, "<\"") {
+						if strings.HasPrefix(name, ".") {
+							continue
+						}
+
+						if !util.IsValidUploadFileName(html.UnescapeString(name)) {
+							// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
+							logging.LogWarnf("invalid custom emoji name [%s]", name)
 							continue
 						}
 

kernel/util/file.go

@@ -184,6 +184,10 @@ func IsCorruptedSYData(data []byte) bool {
 	return false
 }
 
+func IsValidUploadFileName(name string) bool {
+	return name == FilterUploadFileName(name)
+}
+
 func FilterUploadFileName(name string) string {
 	ret := FilterFileName(name)