Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 15:10:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-17 20:59:31 +08:00
parent d33c9d736b
commit be2cd45eac
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
kernel/model/blockinfo.go
View file

@ -17,7 +17,6 @@
package model package model
import ( import (
"github.com/emirpasic/gods/sets/hashset"
"os" "os"
"path/filepath" "path/filepath"
"sort" "sort"
@ -28,6 +27,7 @@ import (
"github.com/88250/lute/ast" "github.com/88250/lute/ast"
"github.com/88250/lute/editor" "github.com/88250/lute/editor"
"github.com/88250/lute/parse" "github.com/88250/lute/parse"
"github.com/emirpasic/gods/sets/hashset"
"github.com/siyuan-note/logging" "github.com/siyuan-note/logging"
"github.com/siyuan-note/siyuan/kernel/av" "github.com/siyuan-note/siyuan/kernel/av"
"github.com/siyuan-note/siyuan/kernel/filesys" "github.com/siyuan-note/siyuan/kernel/filesys"
@ -65,6 +65,13 @@ func GetDocInfo(blockID string) (ret *BlockInfo) {
title := tree.Root.IALAttr("title") title := tree.Root.IALAttr("title")
ret = &BlockInfo{ID: blockID, RootID: tree.Root.ID, Name: title} ret = &BlockInfo{ID: blockID, RootID: tree.Root.ID, Name: title}
ret.IAL = parse.IAL2Map(tree.Root.KramdownIAL) ret.IAL = parse.IAL2Map(tree.Root.KramdownIAL)
icon := ret.IAL["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
ret.IAL["icon"] = icon
}
scrollData := ret.IAL["scroll"] scrollData := ret.IAL["scroll"]
if 0 < len(scrollData) { if 0 < len(scrollData) {
scroll := map[string]interface{}{} scroll := map[string]interface{}{}
@ -131,7 +138,12 @@ func GetDocInfo(blockID string) (ret *BlockInfo) {
} }
} }
ret.SubFileCount = subFileCount ret.SubFileCount = subFileCount
ret.Icon = tree.Root.IALAttr("icon") icon = tree.Root.IALAttr("icon")
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
}
ret.Icon = icon
return return
} }

7
kernel/model/box.go
View file

@ -196,6 +196,13 @@ func (box *Box) GetConf() (ret *conf.BoxConf) {
logging.LogErrorf("parse box conf [%s] failed: %s", confPath, err) logging.LogErrorf("parse box conf [%s] failed: %s", confPath, err)
return return
} }
icon := ret.Icon
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
ret.Icon = icon
}
return return
} }