Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-16 22:50:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034

Browse source
This commit is contained in:
Daniel 2025-06-16 17:01:22 +08:00
parent 09f0fce4f4
commit 95ae34c7b1
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
kernel/api/system.go
View file

@ -173,6 +173,7 @@ func getEmojiConf(c *gin.Context) {
if !util.IsValidUploadFileName(html.UnescapeString(name)) {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
logging.LogWarnf("invalid custom emoji name [%s]", name)
continue
}
if customEmoji.IsDir() {