Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2025-12-17 23:20:13 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034 https://github.com/siyuan-note/siyuan/pull/15041

Browse source
This commit is contained in:
Daniel 2025-06-17 18:00:44 +08:00
parent 809e8c151c
commit d0dbc9b551
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
kernel/api/block.go
View file

@ -626,13 +626,18 @@ func getBlockInfo(c *gin.Context) {
} }
rootTitle := root.IAL["title"] rootTitle := root.IAL["title"]
rootTitle = html.UnescapeString(rootTitle) rootTitle = html.UnescapeString(rootTitle)
icon := root.IAL["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
}
ret.Data = map[string]string{ ret.Data = map[string]string{
"box": block.Box, "box": block.Box,
"path": block.Path, "path": block.Path,
"rootID": block.RootID, "rootID": block.RootID,
"rootTitle": rootTitle, "rootTitle": rootTitle,
"rootChildID": rootChildID, "rootChildID": rootChildID,
"rootIcon": root.IAL["icon"], "rootIcon": icon,
} }
} }

7
kernel/model/file.go
View file

@ -80,7 +80,12 @@ func (box *Box) docFromFileInfo(fileInfo *FileInfo, ial map[string]string) (ret
ret.Path = fileInfo.path ret.Path = fileInfo.path
ret.Size = uint64(fileInfo.size) ret.Size = uint64(fileInfo.size)
ret.Name = ial["title"] + ".sy" ret.Name = ial["title"] + ".sy"
ret.Icon = ial["icon"] icon := ial["icon"]
if strings.Contains(icon, ".") {
// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
icon = util.FilterUploadFileName(icon)
}
ret.Icon = icon
ret.ID = ial["id"] ret.ID = ial["id"]
ret.Name1 = ial["name"] ret.Name1 = ial["name"]
ret.Alias = ial["alias"] ret.Alias = ial["alias"]