Andreas/siyuan
1
0
Fork 0
mirror of https://github.com/siyuan-note/siyuan.git synced 2026-03-08 05:32:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

🔒 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6865-qjcf-286f

Browse source 
Signed-off-by: Daniel <845765@qq.com>
This commit is contained in:
Daniel 2026-03-04 11:48:09 +08:00
parent 285f7c216a
commit d68bd5a793
No known key found for this signature in database
GPG key ID: 86211BA83DF03017
3 changed files with 56 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
kernel/server/serve.go
View file

@ -618,7 +618,7 @@ func serveSVG(context *gin.Context, assetAbsPath string) bool {
}
if !model.Conf.Editor.AllowSVGScript {
data = []byte(util.RemoveScriptsInSVG(string(data)))
data = []byte(util.SanitizeSVG(string(data)))
}
context.Data(200, "image/svg+xml", data)