Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-16 22:50:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-17 20:59:31 +08:00
parent d33c9d736b
commit be2cd45eac
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
kernel/model/box.go
View file

@ -196,6 +196,13 @@ func (box *Box) GetConf() (ret *conf.BoxConf) {
logging.LogErrorf("parse box conf [%s] failed: %s", confPath, err)
return
}
icon := ret.Icon
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
ret.Icon = icon
}
return
}