Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-03-12 23:46:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 getDynamicIcon interface XSS vulnerability https://github.com/siyuan-note/siyuan/issues/17166

Browse source 
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5hc8-qmg8-pw27

Signed-off-by: Daniel <845765@qq.com>
This commit is contained in:
Daniel 2026-03-09 16:10:44 +08:00
parent 2a75d4d4f9
commit 9c4b184bef
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
kernel/util/misc.go
View file

@ -247,7 +247,8 @@ func SanitizeSVG(svgInput string) string {
next := c.NextSibling
if c.Type == html.ElementNode {
tag := strings.ToLower(c.Data)
if tag == "script" || tag == "iframe" || tag == "object" || tag == "embed" || tag == "foreignobject" {
if tag == "script" || tag == "iframe" || tag == "object" || tag == "embed" || tag == "foreignobject" || "animate" == tag ||
"animatetransform" == tag || "animatecolor" == tag || "animatemotion" == tag || "set" == tag {
n.RemoveChild(c)
c = next
continue
@ -266,6 +267,13 @@ func SanitizeSVG(svgInput string) string {
continue
}
if key == "values" || key == "from" || key == "to" {
// 删除 animate* 元素的 values、from、to 属性以防止恶意动画
if strings.Contains(val, "javascript:") {
continue
}
}
// 删除 href 或 xlink:href 指向 javascript: 或某些不安全的 data: URI
if key == "href" || key == "xlink:href" || key == "xlinkhref" {
if strings.HasPrefix(val, "javascript:") {